Merge branch 'extract_file_permissions' into 'master'

Extract file and executable permissions to perm package

See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5359

Merged-by: Sami Hiltunen <shiltunen@gitlab.com>
Approved-by: karthik nayak <knayak@gitlab.com>
Reviewed-by: karthik nayak <knayak@gitlab.com>
Co-authored-by: James Fargher <jfargher@gitlab.com>

82 files changed, 341 insertions, 270 deletions

diff --git a/cmd/gitaly-wrapper/main_test.go b/cmd/gitaly-wrapper/main_test.go
index 5a78f90a1..9eb53340d 100644
--- a/cmd/gitaly-wrapper/main_test.go
+++ b/cmd/gitaly-wrapper/main_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/bootstrap"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
 )
@@ -69,7 +70,7 @@ func TestFindProcess(t *testing.T) {
 		t.Parallel()
 
 		path := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(path, []byte("garbage"), 0o644))
+		require.NoError(t, os.WriteFile(path, []byte("garbage"), perm.SharedFile))
 
 		_, err := findProcess(path)
 		_, expectedErr := strconv.Atoi("garbage")
@@ -82,7 +83,7 @@ func TestFindProcess(t *testing.T) {
 		// The below PID can exist, but chances are sufficiently low to hopefully not matter
 		// in practice.
 		path := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(path, []byte("7777777"), 0o644))
+		require.NoError(t, os.WriteFile(path, []byte("7777777"), perm.SharedFile))
 
 		// The process isn't alive, so we expect neither an error nor a process to be
 		// returned.
@@ -117,7 +118,7 @@ func TestFindProcess(t *testing.T) {
 		require.NoError(t, err)
 
 		path := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(path, []byte(strconv.FormatInt(int64(cmd.Process.Pid), 10)), 0o644))
+		require.NoError(t, os.WriteFile(path, []byte(strconv.FormatInt(int64(cmd.Process.Pid), 10)), perm.SharedFile))
 
 		process, err := findProcess(path)
 		require.NotNil(t, process)
@@ -175,7 +176,7 @@ func TestReadPIDFile(t *testing.T) {
 		t.Parallel()
 
 		path := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(path, nil, 0o644))
+		require.NoError(t, os.WriteFile(path, nil, perm.SharedFile))
 		_, err := readPIDFile(path)
 		_, expectedErr := strconv.Atoi("")
 		require.Equal(t, expectedErr, err)
@@ -185,7 +186,7 @@ func TestReadPIDFile(t *testing.T) {
 		t.Parallel()
 
 		path := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(path, []byte("invalid"), 0o644))
+		require.NoError(t, os.WriteFile(path, []byte("invalid"), perm.SharedFile))
 		_, err := readPIDFile(path)
 		_, expectedErr := strconv.Atoi("invalid")
 		require.Equal(t, expectedErr, err)
@@ -195,7 +196,7 @@ func TestReadPIDFile(t *testing.T) {
 		t.Parallel()
 
 		path := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(path, []byte("12345"), 0o644))
+		require.NoError(t, os.WriteFile(path, []byte("12345"), perm.SharedFile))
 		pid, err := readPIDFile(path)
 		require.NoError(t, err)
 		require.Equal(t, 12345, pid)
@@ -348,7 +349,7 @@ func TestRun(t *testing.T) {
 		// Write the PID of the running process into the PID file. As a result, it should
 		// get adopted by gitaly-wrapper, which means it wouldn't try to execute it anew.
 		pidPath := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(pidPath, []byte(strconv.FormatInt(int64(scriptCmd.Process.Pid), 10)), 0o644))
+		require.NoError(t, os.WriteFile(pidPath, []byte(strconv.FormatInt(int64(scriptCmd.Process.Pid), 10)), perm.SharedFile))
 
 		// Run gitaly-script with a binary path whose basename matches, but which ultimately
 		// doesn't exist. This proves that it doesn't try to execute the script again.
@@ -412,7 +413,7 @@ func TestRun(t *testing.T) {
 		`))
 
 		pidPath := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(pidPath, []byte("12345"), 0o644))
+		require.NoError(t, os.WriteFile(pidPath, []byte("12345"), perm.SharedFile))
 
 		cmd := exec.CommandContext(ctx, binary, script)
 		cmd.Env = append(os.Environ(), fmt.Sprintf("%s=%s", bootstrap.EnvPidFile, pidPath))
@@ -443,7 +444,7 @@ func TestRun(t *testing.T) {
 		require.NoError(t, err)
 
 		pidPath := filepath.Join(testhelper.TempDir(t), "pid")
-		require.NoError(t, os.WriteFile(pidPath, []byte(strconv.FormatInt(int64(scriptCmd.Process.Pid), 10)), 0o644))
+		require.NoError(t, os.WriteFile(pidPath, []byte(strconv.FormatInt(int64(scriptCmd.Process.Pid), 10)), perm.SharedFile))
 
 		cmd := exec.CommandContext(ctx, binary, script)
 		cmd.Env = append(os.Environ(), fmt.Sprintf("%s=%s", bootstrap.EnvPidFile, pidPath))
diff --git a/cmd/gitaly/check_test.go b/cmd/gitaly/check_test.go
index 19f5a3ea1..b880e5275 100644
--- a/cmd/gitaly/check_test.go
+++ b/cmd/gitaly/check_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitlab"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
 )
@@ -113,7 +114,7 @@ func writeTemporaryGitalyConfigFile(tb testing.TB, cfg config.Cfg) string {
 
 	contents, err := toml.Marshal(cfg)
 	require.NoError(tb, err)
-	require.NoError(tb, os.WriteFile(path, contents, 0o644))
+	require.NoError(tb, os.WriteFile(path, contents, perm.SharedFile))
 
 	return path
 }
diff --git a/internal/backup/backup_test.go b/internal/backup/backup_test.go
index 8bf225ff1..753af831e 100644
--- a/internal/backup/backup_test.go
+++ b/internal/backup/backup_test.go
@@ -61,7 +61,7 @@ func TestManager_Create(t *testing.T) {
 					Seed: gittest.SeedGitLabTest,
 				})
 				require.NoError(tb, os.Mkdir(filepath.Join(hooksRepoPath, "custom_hooks"), perm.PublicDir))
-				require.NoError(tb, os.WriteFile(filepath.Join(hooksRepoPath, "custom_hooks/pre-commit.sample"), []byte("Some hooks"), os.ModePerm))
+				require.NoError(tb, os.WriteFile(filepath.Join(hooksRepoPath, "custom_hooks/pre-commit.sample"), []byte("Some hooks"), perm.PublicFile))
 				return hooksRepo, hooksRepoPath
 			},
 			createsBundle:      true,
@@ -122,11 +122,11 @@ func TestManager_Create(t *testing.T) {
 
 				dirInfo, err := os.Stat(filepath.Dir(bundlePath))
 				require.NoError(t, err)
-				require.Equal(t, os.FileMode(0o700), dirInfo.Mode().Perm(), "expecting restricted directory permissions")
+				require.Equal(t, perm.PrivateDir, dirInfo.Mode().Perm(), "expecting restricted directory permissions")
 
 				bundleInfo, err := os.Stat(bundlePath)
 				require.NoError(t, err)
-				require.Equal(t, os.FileMode(0o600), bundleInfo.Mode().Perm(), "expecting restricted file permissions")
+				require.Equal(t, perm.PrivateFile, bundleInfo.Mode().Perm(), "expecting restricted file permissions")
 
 				output := gittest.Exec(t, cfg, "-C", repoPath, "bundle", "verify", bundlePath)
 				require.Contains(t, string(output), "The bundle records a complete history")
@@ -189,10 +189,10 @@ func TestManager_Create_incremental(t *testing.T) {
 				gittest.Exec(tb, cfg, "-C", repoPath, "bundle", "create", bundlePath, "--all")
 
 				refs := gittest.Exec(tb, cfg, "-C", repoPath, "show-ref", "--head")
-				require.NoError(tb, os.WriteFile(refsPath, refs, os.ModePerm))
+				require.NoError(tb, os.WriteFile(refsPath, refs, perm.PublicFile))
 
-				require.NoError(tb, os.WriteFile(filepath.Join(backupRepoPath, "LATEST"), []byte(backupID), os.ModePerm))
-				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("001"), os.ModePerm))
+				require.NoError(tb, os.WriteFile(filepath.Join(backupRepoPath, "LATEST"), []byte(backupID), perm.PublicFile))
+				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("001"), perm.PublicFile))
 
 				return repo, repoPath
 			},
@@ -214,10 +214,10 @@ func TestManager_Create_incremental(t *testing.T) {
 				gittest.Exec(tb, cfg, "-C", repoPath, "bundle", "create", bundlePath, "--all")
 
 				refs := gittest.Exec(tb, cfg, "-C", repoPath, "show-ref", "--head")
-				require.NoError(tb, os.WriteFile(refsPath, refs, os.ModePerm))
+				require.NoError(tb, os.WriteFile(refsPath, refs, perm.PublicFile))
 
-				require.NoError(tb, os.WriteFile(filepath.Join(backupRepoPath, "LATEST"), []byte(backupID), os.ModePerm))
-				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("001"), os.ModePerm))
+				require.NoError(tb, os.WriteFile(filepath.Join(backupRepoPath, "LATEST"), []byte(backupID), perm.PublicFile))
+				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("001"), perm.PublicFile))
 
 				gittest.WriteCommit(tb, cfg, repoPath, gittest.WithBranch("master"))
 
@@ -381,8 +381,8 @@ func testManagerRestore(t *testing.T, ctx context.Context) {
 				repoBackupPath := joinBackupPath(tb, backupRoot, repo)
 				backupPath := filepath.Join(repoBackupPath, backupID)
 				require.NoError(tb, os.MkdirAll(backupPath, perm.PublicDir))
-				require.NoError(tb, os.WriteFile(filepath.Join(repoBackupPath, "LATEST"), []byte(backupID), os.ModePerm))
-				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("001"), os.ModePerm))
+				require.NoError(tb, os.WriteFile(filepath.Join(repoBackupPath, "LATEST"), []byte(backupID), perm.PublicFile))
+				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("001"), perm.PublicFile))
 				bundlePath := filepath.Join(backupPath, "001.bundle")
 				gittest.BundleRepo(tb, cfg, repoPath, bundlePath)
 
@@ -402,8 +402,8 @@ func testManagerRestore(t *testing.T, ctx context.Context) {
 				repoBackupPath := joinBackupPath(tb, backupRoot, repo)
 				backupPath := filepath.Join(repoBackupPath, backupID)
 				require.NoError(tb, os.MkdirAll(backupPath, perm.PublicDir))
-				require.NoError(tb, os.WriteFile(filepath.Join(repoBackupPath, "LATEST"), []byte(backupID), os.ModePerm))
-				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("002"), os.ModePerm))
+				require.NoError(tb, os.WriteFile(filepath.Join(repoBackupPath, "LATEST"), []byte(backupID), perm.PublicFile))
+				require.NoError(tb, os.WriteFile(filepath.Join(backupPath, "LATEST"), []byte("002"), perm.PublicFile))
 
 				root := gittest.WriteCommit(tb, cfg, expectedRepoPath,
 					gittest.WithBranch("master"),
@@ -533,7 +533,7 @@ func TestResolveSink(t *testing.T) {
   "token_uri": "https://accounts.google.com/o/oauth2/token",
   "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
   "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/303724477529-compute%40developer.gserviceaccount.com"
-}`), 0o655))
+}`), perm.SharedFile))
 
 	for _, tc := range []struct {
 		desc   string
diff --git a/internal/backup/filesystem_sink.go b/internal/backup/filesystem_sink.go
index e9dad6188..f97a409e9 100644
--- a/internal/backup/filesystem_sink.go
+++ b/internal/backup/filesystem_sink.go
@@ -32,7 +32,7 @@ func (fs *FilesystemSink) Write(ctx context.Context, relativePath string, r io.R
 		return fmt.Errorf("create directory structure %q: %w", dir, err)
 	}
 
-	f, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
+	f, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, perm.PrivateFile)
 	if err != nil {
 		return fmt.Errorf("write file %q: %w", path, err)
 	}
diff --git a/internal/backup/filesystem_sink_test.go b/internal/backup/filesystem_sink_test.go
index 7e4025851..fbb6b67b7 100644
--- a/internal/backup/filesystem_sink_test.go
+++ b/internal/backup/filesystem_sink_test.go
@@ -24,7 +24,7 @@ func TestFilesystemSink_GetReader(t *testing.T) {
 
 		dir := testhelper.TempDir(t)
 		const relativePath = "test.dat"
-		require.NoError(t, os.WriteFile(filepath.Join(dir, relativePath), []byte("test"), 0o644))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, relativePath), []byte("test"), perm.SharedFile))
 
 		fsSink := NewFilesystemSink(dir)
 		reader, err := fsSink.GetReader(ctx, relativePath)
@@ -79,7 +79,7 @@ func TestFilesystemSink_Write(t *testing.T) {
 		fullPath := filepath.Join(dir, relativePath)
 
 		require.NoError(t, os.MkdirAll(filepath.Dir(fullPath), perm.SharedDir))
-		require.NoError(t, os.WriteFile(fullPath, []byte("initial"), 0o655))
+		require.NoError(t, os.WriteFile(fullPath, []byte("initial"), perm.SharedFile))
 
 		fsSink := NewFilesystemSink(dir)
 		require.NoError(t, fsSink.Write(ctx, relativePath, strings.NewReader("test")))
@@ -96,7 +96,7 @@ func TestFilesystemSink_Write(t *testing.T) {
 
 		dir := testhelper.TempDir(t)
 		const relativePath = "nested/test.dat"
-		require.NoError(t, os.WriteFile(filepath.Join(dir, "nested"), []byte("lock"), os.ModePerm))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "nested"), []byte("lock"), perm.PublicFile))
 
 		fsSink := NewFilesystemSink(dir)
 		err := fsSink.Write(ctx, relativePath, strings.NewReader("test"))
diff --git a/internal/backup/locator_test.go b/internal/backup/locator_test.go
index fb8802b6c..4096cb135 100644
--- a/internal/backup/locator_test.go
+++ b/internal/backup/locator_test.go
@@ -193,8 +193,8 @@ func TestPointerLocator(t *testing.T) {
 			require.ErrorIs(t, err, ErrDoesntExist)
 
 			require.NoError(t, os.MkdirAll(filepath.Join(backupPath, repo.RelativePath, backupID), perm.SharedDir))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte(backupID), 0o644))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, backupID, "LATEST"), []byte("003"), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte(backupID), perm.SharedFile))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, backupID, "LATEST"), []byte("003"), perm.SharedFile))
 			expected := &Backup{
 				Steps: []Step{
 					{
@@ -247,8 +247,8 @@ func TestPointerLocator(t *testing.T) {
 			require.Equal(t, expectedFallback, fallbackFull)
 
 			require.NoError(t, os.MkdirAll(filepath.Join(backupPath, repo.RelativePath, backupID), perm.SharedDir))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte(backupID), 0o644))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, backupID, "LATEST"), []byte("001"), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte(backupID), perm.SharedFile))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, backupID, "LATEST"), []byte("001"), perm.SharedFile))
 			expected := &Backup{
 				Steps: []Step{
 					{
@@ -276,7 +276,7 @@ func TestPointerLocator(t *testing.T) {
 			require.ErrorIs(t, err, ErrDoesntExist)
 
 			require.NoError(t, os.MkdirAll(filepath.Join(backupPath, repo.RelativePath), perm.SharedDir))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte("invalid"), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte("invalid"), perm.SharedFile))
 			_, err = l.FindLatest(ctx, repo)
 			require.EqualError(t, err, "pointer locator: find latest: find: find latest ID: filesystem sink: get reader for \"TestPointerLocator/invalid/LATEST\": doesn't exist")
 		})
@@ -293,8 +293,8 @@ func TestPointerLocator(t *testing.T) {
 			require.ErrorIs(t, err, ErrDoesntExist)
 
 			require.NoError(t, os.MkdirAll(filepath.Join(backupPath, repo.RelativePath, backupID), perm.SharedDir))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte(backupID), 0o644))
-			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, backupID, "LATEST"), []byte("invalid"), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, "LATEST"), []byte(backupID), perm.SharedFile))
+			require.NoError(t, os.WriteFile(filepath.Join(backupPath, repo.RelativePath, backupID, "LATEST"), []byte("invalid"), perm.SharedFile))
 
 			_, err = l.FindLatest(ctx, repo)
 			require.EqualError(t, err, "pointer locator: find latest: find: determine increment ID: strconv.Atoi: parsing \"invalid\": invalid syntax")
diff --git a/internal/bootstrap/bootstrap_test.go b/internal/bootstrap/bootstrap_test.go
index 0b3eae895..61f1f0efd 100644
--- a/internal/bootstrap/bootstrap_test.go
+++ b/internal/bootstrap/bootstrap_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 )
 
@@ -77,7 +78,7 @@ func TestBootstrap_unixListener(t *testing.T) {
 			require.NoError(t, err)
 
 			if tc.preexistingSocket {
-				require.NoError(t, os.WriteFile(socketPath, nil, 0o755))
+				require.NoError(t, os.WriteFile(socketPath, nil, perm.SharedExecutable))
 			}
 
 			listener, err := b.listen("unix", socketPath)
diff --git a/internal/cache/walker_test.go b/internal/cache/walker_test.go
index d587dae74..0d1722fc5 100644
--- a/internal/cache/walker_test.go
+++ b/internal/cache/walker_test.go
@@ -79,7 +79,7 @@ func TestDiskCacheInitialClear(t *testing.T) {
 
 	canary := filepath.Join(cacheDir, "canary.txt")
 	require.NoError(t, os.MkdirAll(filepath.Dir(canary), perm.SharedDir))
-	require.NoError(t, os.WriteFile(canary, []byte("chirp chirp"), 0o755))
+	require.NoError(t, os.WriteFile(canary, []byte("chirp chirp"), perm.SharedExecutable))
 
 	cache := New(cfg, locator, withDisabledWalker())
 	require.NoError(t, cache.StartWalkers())
@@ -116,7 +116,7 @@ func TestCleanWalkEmptyDirs(t *testing.T) {
 		if strings.HasSuffix(tt.path, "/") {
 			require.NoError(t, os.MkdirAll(p, perm.SharedDir))
 		} else {
-			require.NoError(t, os.WriteFile(p, nil, 0o655))
+			require.NoError(t, os.WriteFile(p, nil, perm.SharedFile))
 			if tt.stale {
 				require.NoError(t, os.Chtimes(p, time.Now(), time.Now().Add(-time.Hour)))
 			}
diff --git a/internal/cgroups/mock_linux_test.go b/internal/cgroups/mock_linux_test.go
index 6857429c7..d54add8d0 100644
--- a/internal/cgroups/mock_linux_test.go
+++ b/internal/cgroups/mock_linux_test.go
@@ -101,7 +101,7 @@ func (m *mockCgroup) setupMockCgroupFiles(
 
 		for filename, content := range contentByFilename {
 			controlFilePath := filepath.Join(cgroupPath, filename)
-			require.NoError(t, os.WriteFile(controlFilePath, []byte(content), 0o644))
+			require.NoError(t, os.WriteFile(controlFilePath, []byte(content), perm.SharedFile))
 		}
 
 		for shard := uint(0); shard < manager.cfg.Repositories.Count; shard++ {
@@ -110,7 +110,7 @@ func (m *mockCgroup) setupMockCgroupFiles(
 
 			for filename, content := range contentByFilename {
 				shardControlFilePath := filepath.Join(shardPath, filename)
-				require.NoError(t, os.WriteFile(shardControlFilePath, []byte(content), 0o644))
+				require.NoError(t, os.WriteFile(shardControlFilePath, []byte(content), perm.SharedFile))
 			}
 		}
 	}
diff --git a/internal/cgroups/v1_linux_test.go b/internal/cgroups/v1_linux_test.go
index cb249f64d..7f56d87e1 100644
--- a/internal/cgroups/v1_linux_test.go
+++ b/internal/cgroups/v1_linux_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config/cgroups"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 )
 
@@ -221,7 +222,7 @@ func readCgroupFile(t *testing.T, path string) []byte {
 	// The cgroups package defaults to permission 0 as it expects the file to be existing (the kernel creates the file)
 	// and its testing override the permission private variable to something sensible, hence we have to chmod ourselves
 	// so we can read the file.
-	require.NoError(t, os.Chmod(path, 0o666))
+	require.NoError(t, os.Chmod(path, perm.PublicFile))
 
 	return testhelper.MustReadFile(t, path)
 }
diff --git a/internal/git/conflict/parser_test.go b/internal/git/conflict/parser_test.go
index 52c308320..5b3eccff6 100644
--- a/internal/git/conflict/parser_test.go
+++ b/internal/git/conflict/parser_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 func TestFile_Resolve(t *testing.T) {
@@ -111,7 +112,7 @@ we can both agree on this line though
 		t.Run(tt.name, func(t *testing.T) {
 			entry := Entry{
 				Path:     tt.path,
-				Mode:     0o644,
+				Mode:     uint(perm.SharedFile),
 				Contents: []byte("something-with-trailing-newline\n"),
 			}
 
diff --git a/internal/git/dirs_test.go b/internal/git/dirs_test.go
index ae1d7c138..0ebe4292d 100644
--- a/internal/git/dirs_test.go
+++ b/internal/git/dirs_test.go
@@ -73,7 +73,7 @@ func TestObjectDirsOutsideStorage(t *testing.T) {
 		t.Run(tc.desc, func(t *testing.T) {
 			ctx := testhelper.Context(t)
 
-			require.NoError(t, os.WriteFile(alternatesFile, []byte(tc.alternates), 0o600))
+			require.NoError(t, os.WriteFile(alternatesFile, []byte(tc.alternates), perm.PrivateFile))
 			out, err := ObjectDirectories(ctx, storageRoot, repoPath)
 			require.Equal(t, expectedErr, err)
 			require.Nil(t, out)
diff --git a/internal/git/execution_environment_test.go b/internal/git/execution_environment_test.go
index a4b8987c7..59aea70bd 100644
--- a/internal/git/execution_environment_test.go
+++ b/internal/git/execution_environment_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 )
 
@@ -73,7 +74,7 @@ func TestBundledGitEnvironmentConstructor(t *testing.T) {
 	seedDirWithExecutables := func(t *testing.T, executableNames ...string) string {
 		dir := testhelper.TempDir(t)
 		for _, executableName := range executableNames {
-			require.NoError(t, os.WriteFile(filepath.Join(dir, executableName), nil, 0o777))
+			require.NoError(t, os.WriteFile(filepath.Join(dir, executableName), nil, perm.PublicExecutable))
 		}
 		return dir
 	}
@@ -241,7 +242,7 @@ func TestFallbackGitEnvironmentConstructor(t *testing.T) {
 	t.Run("successfully resolved executable", func(t *testing.T) {
 		tempDir := testhelper.TempDir(t)
 		gitPath := filepath.Join(tempDir, "git")
-		require.NoError(t, os.WriteFile(gitPath, nil, 0o755))
+		require.NoError(t, os.WriteFile(gitPath, nil, perm.SharedExecutable))
 
 		t.Setenv("PATH", "/does/not/exist:"+tempDir)
 
diff --git a/internal/git/gitattributes/check_attr_test.go b/internal/git/gitattributes/check_attr_test.go
index b39003110..3b2a0fd01 100644
--- a/internal/git/gitattributes/check_attr_test.go
+++ b/internal/git/gitattributes/check_attr_test.go
@@ -139,7 +139,7 @@ func TestCheckAttrCmd_Check(t *testing.T) {
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
-			require.NoError(t, os.WriteFile(attrPath, []byte(tc.attrContent), 0o644))
+			require.NoError(t, os.WriteFile(attrPath, []byte(tc.attrContent), perm.SharedFile))
 
 			checkCmd, finish, err := CheckAttr(ctx, repo, []string{"foo", "bar"})
 			require.NoError(t, err)
diff --git a/internal/git/gittest/http_server.go b/internal/git/gittest/http_server.go
index ef3fd14fd..c69c9aa6f 100644
--- a/internal/git/gittest/http_server.go
+++ b/internal/git/gittest/http_server.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 )
 
@@ -18,7 +19,7 @@ import (
 // prepared such that git-http-backend(1) will serve it by creating the "git-daemon-export-ok" magic
 // file.
 func HTTPServer(tb testing.TB, ctx context.Context, gitCmdFactory git.CommandFactory, repoPath string, middleware func(http.ResponseWriter, *http.Request, http.Handler)) int {
-	require.NoError(tb, os.WriteFile(filepath.Join(repoPath, "git-daemon-export-ok"), nil, 0o644))
+	require.NoError(tb, os.WriteFile(filepath.Join(repoPath, "git-daemon-export-ok"), nil, perm.SharedFile))
 
 	listener, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(tb, err)
diff --git a/internal/git/housekeeping/clean_stale_data.go b/internal/git/housekeeping/clean_stale_data.go
index 4c5911643..5d896ea4f 100644
--- a/internal/git/housekeeping/clean_stale_data.go
+++ b/internal/git/housekeeping/clean_stale_data.go
@@ -15,6 +15,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"google.golang.org/grpc/codes"
@@ -24,7 +25,7 @@ const (
 	emptyRefsGracePeriod             = 24 * time.Hour
 	deleteTempFilesOlderThanDuration = 7 * 24 * time.Hour
 	brokenRefsGracePeriod            = 24 * time.Hour
-	minimumDirPerm                   = 0o700
+	minimumDirPerm                   = perm.PrivateDir
 	lockfileGracePeriod              = 15 * time.Minute
 	referenceLockfileGracePeriod     = 1 * time.Hour
 	packedRefsLockGracePeriod        = 1 * time.Hour
diff --git a/internal/git/housekeeping/clean_stale_data_test.go b/internal/git/housekeeping/clean_stale_data_test.go
index 3352764da..3a7c468d8 100644
--- a/internal/git/housekeeping/clean_stale_data_test.go
+++ b/internal/git/housekeeping/clean_stale_data_test.go
@@ -49,7 +49,7 @@ func (f *fileEntry) create(t *testing.T, parent string) {
 	t.Helper()
 
 	filename := filepath.Join(parent, f.name)
-	ff, err := os.OpenFile(filename, os.O_RDONLY|os.O_CREATE, 0o700)
+	ff, err := os.OpenFile(filename, os.O_RDONLY|os.O_CREATE, perm.PrivateFile)
 	assert.NoError(t, err, "file creation failed: %v", filename)
 	err = ff.Close()
 	assert.NoError(t, err, "file close failed: %v", filename)
@@ -185,18 +185,18 @@ func TestRepositoryManager_CleanStaleData(t *testing.T) {
 		{
 			name: "clean",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
-					f("a", 0o700, 24*time.Hour, Keep),
-					f("b", 0o700, 24*time.Hour, Keep),
-					f("c", 0o700, 24*time.Hour, Keep),
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
+					f("a", perm.PrivateFile, 24*time.Hour, Keep),
+					f("b", perm.PrivateFile, 24*time.Hour, Keep),
+					f("c", perm.PrivateFile, 24*time.Hour, Keep),
 				),
 			},
 		},
 		{
 			name: "emptyperms",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
-					f("b", 0o700, 24*time.Hour, Keep),
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
+					f("b", perm.PrivateFile, 24*time.Hour, Keep),
 					f("tmp_a", 0o000, 2*time.Hour, Keep),
 				),
 			},
@@ -204,18 +204,18 @@ func TestRepositoryManager_CleanStaleData(t *testing.T) {
 		{
 			name: "emptytempdir",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
 					d("tmp_d", 0o000, 240*time.Hour, Keep),
-					f("b", 0o700, 24*time.Hour, Keep),
+					f("b", perm.PrivateFile, 24*time.Hour, Keep),
 				),
 			},
 		},
 		{
 			name: "oldtempfile",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
-					f("tmp_a", 0o770, 240*time.Hour, Delete),
-					f("b", 0o700, 24*time.Hour, Keep),
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
+					f("tmp_a", perm.SharedFile, 240*time.Hour, Delete),
+					f("b", perm.PrivateFile, 24*time.Hour, Keep),
 				),
 			},
 			expectedMetrics: cleanStaleDataMetrics{
@@ -225,9 +225,9 @@ func TestRepositoryManager_CleanStaleData(t *testing.T) {
 		{
 			name: "subdir temp file",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
-					d("a", 0o770, 240*time.Hour, Keep,
-						f("tmp_b", 0o700, 240*time.Hour, Delete),
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
+					d("a", perm.GroupPrivateDir, 240*time.Hour, Keep,
+						f("tmp_b", perm.PrivateFile, 240*time.Hour, Delete),
 					),
 				),
 			},
@@ -238,9 +238,9 @@ func TestRepositoryManager_CleanStaleData(t *testing.T) {
 		{
 			name: "inaccessible tmp directory",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
 					d("tmp_a", 0o000, 240*time.Hour, Keep,
-						f("tmp_b", 0o700, 240*time.Hour, Delete),
+						f("tmp_b", perm.PrivateFile, 240*time.Hour, Delete),
 					),
 				),
 			},
@@ -248,9 +248,9 @@ func TestRepositoryManager_CleanStaleData(t *testing.T) {
 		{
 			name: "deeply nested inaccessible tmp directory",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
-					d("tmp_a", 0o700, 240*time.Hour, Keep,
-						d("tmp_a", 0o700, 24*time.Hour, Keep,
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
+					d("tmp_a", perm.PrivateDir, 240*time.Hour, Keep,
+						d("tmp_a", perm.PrivateDir, 24*time.Hour, Keep,
 							f("tmp_b", 0o000, 240*time.Hour, Delete),
 						),
 					),
@@ -263,9 +263,9 @@ func TestRepositoryManager_CleanStaleData(t *testing.T) {
 		{
 			name: "files outside of object database",
 			entries: []entry{
-				f("tmp_a", 0o770, 240*time.Hour, Keep),
-				d("info", 0o700, 240*time.Hour, Keep,
-					f("tmp_a", 0o770, 240*time.Hour, Keep),
+				f("tmp_a", perm.SharedFile, 240*time.Hour, Keep),
+				d("info", perm.PrivateDir, 240*time.Hour, Keep,
+					f("tmp_a", perm.SharedFile, 240*time.Hour, Keep),
 				),
 			},
 		},
@@ -395,7 +395,7 @@ func TestRepositoryManager_CleanStaleData_references(t *testing.T) {
 				path := filepath.Join(repoPath, ref.name)
 
 				require.NoError(t, os.MkdirAll(filepath.Dir(path), perm.SharedDir))
-				require.NoError(t, os.WriteFile(path, bytes.Repeat([]byte{0}, ref.size), 0o644))
+				require.NoError(t, os.WriteFile(path, bytes.Repeat([]byte{0}, ref.size), perm.SharedFile))
 				filetime := time.Now().Add(-ref.age)
 				require.NoError(t, os.Chtimes(path, filetime, filetime))
 			}
@@ -431,30 +431,30 @@ func TestRepositoryManager_CleanStaleData_emptyRefDirs(t *testing.T) {
 		{
 			name: "unrelated empty directories",
 			entries: []entry{
-				d("objects", 0o700, 240*time.Hour, Keep,
-					d("empty", 0o700, 240*time.Hour, Keep),
+				d("objects", perm.PrivateDir, 240*time.Hour, Keep,
+					d("empty", perm.PrivateDir, 240*time.Hour, Keep),
 				),
 			},
 		},
 		{
 			name: "empty ref dir gets retained",
 			entries: []entry{
-				d("refs", 0o700, 240*time.Hour, Keep),
+				d("refs", perm.PrivateDir, 240*time.Hour, Keep),
 			},
 		},
 		{
 			name: "empty nested non-stale ref dir gets kept",
 			entries: []entry{
-				d("refs", 0o700, 240*time.Hour, Keep,
-					d("nested", 0o700, 23*time.Hour, Keep),
+				d("refs", perm.PrivateDir, 240*time.Hour, Keep,
+					d("nested", perm.PrivateDir, 23*time.Hour, Keep),
 				),
 			},
 		},
 		{
 			name: "empty nested stale ref dir gets pruned",
 			entries: []entry{
-				d("refs", 0o700, 240*time.Hour, Keep,
-					d("nested", 0o700, 240*time.Hour, Delete),
+				d("refs", perm.PrivateDir, 240*time.Hour, Keep,
+					d("nested", perm.PrivateDir, 240*time.Hour, Delete),
 				),
 			},
 			expectedMetrics: cleanStaleDataMetrics{
@@ -464,9 +464,9 @@ func TestRepositoryManager_CleanStaleData_emptyRefDirs(t *testing.T) {
 		{
 			name: "hierarchy of nested stale ref dirs gets pruned",
 			entries: []entry{
-				d("refs", 0o700, 240*time.Hour, Keep,
-					d("first", 0o700, 240*time.Hour, Delete,
-						d("second", 0o700, 240*time.Hour, Delete),
+				d("refs", perm.PrivateDir, 240*time.Hour, Keep,
+					d("first", perm.PrivateDir, 240*time.Hour, Delete,
+						d("second", perm.PrivateDir, 240*time.Hour, Delete),
 					),
 				),
 			},
@@ -477,10 +477,10 @@ func TestRepositoryManager_CleanStaleData_emptyRefDirs(t *testing.T) {
 		{
 			name: "hierarchy with intermediate non-stale ref dir gets kept",
 			entries: []entry{
-				d("refs", 0o700, 240*time.Hour, Keep,
-					d("first", 0o700, 240*time.Hour, Keep,
-						d("second", 0o700, 1*time.Hour, Keep,
-							d("third", 0o700, 24*time.Hour, Delete),
+				d("refs", perm.PrivateDir, 240*time.Hour, Keep,
+					d("first", perm.PrivateDir, 240*time.Hour, Keep,
+						d("second", perm.PrivateDir, 1*time.Hour, Keep,
+							d("third", perm.PrivateDir, 24*time.Hour, Delete),
 						),
 					),
 				),
@@ -492,13 +492,13 @@ func TestRepositoryManager_CleanStaleData_emptyRefDirs(t *testing.T) {
 		{
 			name: "stale hierrachy with refs gets partially retained",
 			entries: []entry{
-				d("refs", 0o700, 240*time.Hour, Keep,
-					d("first", 0o700, 240*time.Hour, Keep,
-						d("second", 0o700, 240*time.Hour, Delete,
-							d("third", 0o700, 24*time.Hour, Delete),
+				d("refs", perm.PrivateDir, 240*time.Hour, Keep,
+					d("first", perm.PrivateDir, 240*time.Hour, Keep,
+						d("second", perm.PrivateDir, 240*time.Hour, Delete,
+							d("third", perm.PrivateDir, 24*time.Hour, Delete),
 						),
-						d("other", 0o700, 240*time.Hour, Keep,
-							f("ref", 0o700, 1*time.Hour, Keep),
+						d("other", perm.PrivateDir, 240*time.Hour, Keep,
+							f("ref", perm.PrivateFile, 1*time.Hour, Keep),
 						),
 					),
 				),
@@ -550,7 +550,7 @@ func TestRepositoryManager_CleanStaleData_withSpecificFile(t *testing.T) {
 
 		var topLevelDir, currentDir *dirEntry
 		for _, subdir := range subdirs {
-			dir := d(subdir, 0o700, 1*time.Hour, Keep)
+			dir := d(subdir, perm.PrivateDir, 1*time.Hour, Keep)
 			if topLevelDir == nil {
 				topLevelDir = dir
 			}
@@ -662,32 +662,32 @@ func TestRepositoryManager_CleanStaleData_withSpecificFile(t *testing.T) {
 			}{
 				{
 					desc:  fmt.Sprintf("fresh %s is kept", tc.file),
-					entry: f(tc.file, 0o700, 10*time.Minute, Keep),
+					entry: f(tc.file, perm.PrivateFile, 10*time.Minute, Keep),
 				},
 				{
 					desc: fmt.Sprintf("stale %s in subdir is kept", tc.file),
-					entry: d("subdir", 0o700, 240*time.Hour, Keep,
-						f(tc.file, 0o700, 24*time.Hour, Keep),
+					entry: d("subdir", perm.PrivateDir, 240*time.Hour, Keep,
+						f(tc.file, perm.PrivateFile, 24*time.Hour, Keep),
 					),
 				},
 				{
 					desc:  fmt.Sprintf("stale %s is deleted", tc.file),
-					entry: f(tc.file, 0o700, 61*time.Minute, Delete),
+					entry: f(tc.file, perm.PrivateFile, 61*time.Minute, Delete),
 					expectedFiles: []string{
 						filepath.Join(append([]string{repoPath}, append(tc.subdirs, tc.file)...)...),
 					},
 				},
 				{
 					desc:  fmt.Sprintf("%q is kept", tc.file[:len(tc.file)-1]),
-					entry: f(tc.file[:len(tc.file)-1], 0o700, 61*time.Minute, Keep),
+					entry: f(tc.file[:len(tc.file)-1], perm.PrivateFile, 61*time.Minute, Keep),
 				},
 				{
 					desc:  fmt.Sprintf("%q is kept", "~"+tc.file),
-					entry: f("~"+tc.file, 0o700, 61*time.Minute, Keep),
+					entry: f("~"+tc.file, perm.PrivateFile, 61*time.Minute, Keep),
 				},
 				{
 					desc:  fmt.Sprintf("%q is kept", tc.file+"~"),
-					entry: f(tc.file+"~", 0o700, 61*time.Minute, Keep),
+					entry: f(tc.file+"~", perm.PrivateFile, 61*time.Minute, Keep),
 				},
 			} {
 				t.Run(subcase.desc, func(t *testing.T) {
@@ -721,18 +721,18 @@ func TestRepositoryManager_CleanStaleData_serverInfo(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	entries := []entry{
-		d("info", 0o755, 0, Keep,
-			f("ref", 0, 0o644, Keep),
-			f("refs", 0, 0o644, Delete),
-			f("refsx", 0, 0o644, Keep),
-			f("refs_123456", 0, 0o644, Delete),
+		d("info", perm.SharedDir, 0, Keep,
+			f("ref", perm.SharedFile, 0, Keep),
+			f("refs", perm.SharedFile, 0, Delete),
+			f("refsx", perm.SharedFile, 0, Keep),
+			f("refs_123456", perm.SharedFile, 0, Delete),
 		),
-		d("objects", 0o755, 0, Keep,
-			d("info", 0o755, 0, Keep,
-				f("pack", 0, 0o644, Keep),
-				f("packs", 0, 0o644, Delete),
-				f("packsx", 0, 0o644, Keep),
-				f("packs_123456", 0, 0o644, Delete),
+		d("objects", perm.SharedDir, 0, Keep,
+			d("info", perm.SharedDir, 0, Keep,
+				f("pack", perm.SharedFile, 0, Keep),
+				f("packs", perm.SharedFile, 0, Delete),
+				f("packsx", perm.SharedFile, 0, Keep),
+				f("packs_123456", perm.SharedFile, 0, Delete),
 			),
 		),
 	}
@@ -776,18 +776,18 @@ func TestRepositoryManager_CleanStaleData_referenceLocks(t *testing.T) {
 		{
 			desc: "fresh lock is kept",
 			entries: []entry{
-				d("refs", 0o755, 0*time.Hour, Keep,
-					f("main", 0o755, 10*time.Minute, Keep),
-					f("main.lock", 0o755, 10*time.Minute, Keep),
+				d("refs", perm.SharedDir, 0*time.Hour, Keep,
+					f("main", perm.SharedExecutable, 10*time.Minute, Keep),
+					f("main.lock", perm.SharedExecutable, 10*time.Minute, Keep),
 				),
 			},
 		},
 		{
 			desc: "stale lock is deleted",
 			entries: []entry{
-				d("refs", 0o755, 0*time.Hour, Keep,
-					f("main", 0o755, 1*time.Hour, Keep),
-					f("main.lock", 0o755, 1*time.Hour, Delete),
+				d("refs", perm.SharedDir, 0*time.Hour, Keep,
+					f("main", perm.SharedExecutable, 1*time.Hour, Keep),
+					f("main.lock", perm.SharedExecutable, 1*time.Hour, Delete),
 				),
 			},
 			expectedReferenceLocks: []string{
@@ -800,18 +800,18 @@ func TestRepositoryManager_CleanStaleData_referenceLocks(t *testing.T) {
 		{
 			desc: "nested reference locks are deleted",
 			entries: []entry{
-				d("refs", 0o755, 0*time.Hour, Keep,
-					d("tags", 0o755, 0*time.Hour, Keep,
-						f("main", 0o755, 1*time.Hour, Keep),
-						f("main.lock", 0o755, 1*time.Hour, Delete),
+				d("refs", perm.SharedDir, 0*time.Hour, Keep,
+					d("tags", perm.SharedDir, 0*time.Hour, Keep,
+						f("main", perm.SharedExecutable, 1*time.Hour, Keep),
+						f("main.lock", perm.SharedExecutable, 1*time.Hour, Delete),
 					),
-					d("heads", 0o755, 0*time.Hour, Keep,
-						f("main", 0o755, 1*time.Hour, Keep),
-						f("main.lock", 0o755, 1*time.Hour, Delete),
+					d("heads", perm.SharedDir, 0*time.Hour, Keep,
+						f("main", perm.SharedExecutable, 1*time.Hour, Keep),
+						f("main.lock", perm.SharedExecutable, 1*time.Hour, Delete),
 					),
-					d("foobar", 0o755, 0*time.Hour, Keep,
-						f("main", 0o755, 1*time.Hour, Keep),
-						f("main.lock", 0o755, 1*time.Hour, Delete),
+					d("foobar", perm.SharedDir, 0*time.Hour, Keep,
+						f("main", perm.SharedExecutable, 1*time.Hour, Keep),
+						f("main.lock", perm.SharedExecutable, 1*time.Hour, Delete),
 					),
 				),
 			},
@@ -1001,7 +1001,7 @@ func TestRepositoryManager_CleanStaleData_unsetConfiguration(t *testing.T) {
 	else = untouched
 [totally]
 	unrelated = untouched
-`), 0o644))
+`), perm.SharedFile))
 
 	mgr := NewManager(cfg.Prometheus, nil)
 
@@ -1092,7 +1092,7 @@ func TestRepositoryManager_CleanStaleData_pruneEmptyConfigSections(t *testing.T)
 [remote "tmp-03b5e8c765135b343214d471843a062a"]
 [remote "tmp-f57338181aca1d599669dbb71ce9ce57"]
 [remote "tmp-8c948ca94832c2725733e48cb2902287"]
-`), 0o644))
+`), perm.SharedFile))
 
 	mgr := NewManager(cfg.Prometheus, nil)
 
@@ -1240,7 +1240,7 @@ func TestPruneEmptyConfigSections(t *testing.T) {
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
-			require.NoError(t, os.WriteFile(configPath, []byte(tc.configData), 0o644))
+			require.NoError(t, os.WriteFile(configPath, []byte(tc.configData), perm.SharedFile))
 
 			skippedSections, err := pruneEmptyConfigSections(ctx, repo)
 			require.NoError(t, err)
diff --git a/internal/git/housekeeping/optimize_repository_test.go b/internal/git/housekeeping/optimize_repository_test.go
index 831d22f85..318995475 100644
--- a/internal/git/housekeeping/optimize_repository_test.go
+++ b/internal/git/housekeeping/optimize_repository_test.go
@@ -423,7 +423,7 @@ func testOptimizeRepository(t *testing.T, ctx context.Context) {
 
 				for i := 0; i < looseObjectLimit+1; i++ {
 					blobPath := filepath.Join(repoPath, "objects", "17", fmt.Sprintf("%d", i))
-					require.NoError(t, os.WriteFile(blobPath, nil, 0o644))
+					require.NoError(t, os.WriteFile(blobPath, nil, perm.SharedFile))
 					require.NoError(t, os.Chtimes(blobPath, almostTwoWeeksAgo, almostTwoWeeksAgo))
 				}
 
@@ -463,7 +463,7 @@ func testOptimizeRepository(t *testing.T, ctx context.Context) {
 
 				for i := 0; i < looseObjectLimit+1; i++ {
 					blobPath := filepath.Join(repoPath, "objects", "17", fmt.Sprintf("%d", i))
-					require.NoError(t, os.WriteFile(blobPath, nil, 0o644))
+					require.NoError(t, os.WriteFile(blobPath, nil, perm.SharedFile))
 					require.NoError(t, os.Chtimes(blobPath, moreThanTwoWeeksAgo, moreThanTwoWeeksAgo))
 				}
 
diff --git a/internal/git/localrepo/objects_test.go b/internal/git/localrepo/objects_test.go
index 2edca3cd0..3727a574e 100644
--- a/internal/git/localrepo/objects_test.go
+++ b/internal/git/localrepo/objects_test.go
@@ -81,7 +81,7 @@ func testRepoWriteBlob(t *testing.T, ctx context.Context) {
 		t.Run(tc.desc, func(t *testing.T) {
 			attributesPath := filepath.Join(repoPath, "info", "attributes")
 			require.NoError(t, os.MkdirAll(filepath.Dir(attributesPath), perm.SharedDir))
-			require.NoError(t, os.WriteFile(attributesPath, []byte(tc.attributes), os.ModePerm))
+			require.NoError(t, os.WriteFile(attributesPath, []byte(tc.attributes), perm.PublicFile))
 
 			sha, err := repo.WriteBlob(ctx, "file-path", tc.input)
 			require.Equal(t, tc.error, err)
diff --git a/internal/git/localrepo/refs_test.go b/internal/git/localrepo/refs_test.go
index a98009fdf..71866b02e 100644
--- a/internal/git/localrepo/refs_test.go
+++ b/internal/git/localrepo/refs_test.go
@@ -19,6 +19,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -582,7 +583,7 @@ func TestRepo_SetDefaultBranch_errors(t *testing.T) {
 		path, err := repo.Path()
 		require.NoError(t, err)
 
-		require.NoError(t, os.WriteFile(filepath.Join(path, "HEAD.lock"), []byte(""), 0o644))
+		require.NoError(t, os.WriteFile(filepath.Join(path, "HEAD.lock"), []byte(""), perm.SharedFile))
 
 		err = repo.SetDefaultBranch(ctx, &transaction.MockManager{}, "refs/heads/branch")
 		require.ErrorIs(t, err, safe.ErrFileAlreadyLocked)
diff --git a/internal/git/localrepo/repo_test.go b/internal/git/localrepo/repo_test.go
index 25d7f9986..4c69cb599 100644
--- a/internal/git/localrepo/repo_test.go
+++ b/internal/git/localrepo/repo_test.go
@@ -13,6 +13,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/catfile"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
@@ -235,7 +236,7 @@ func TestSize(t *testing.T) {
 				require.NoError(t, os.WriteFile(
 					filepath.Join(repoPath, "objects", "info", "alternates"),
 					[]byte(filepath.Join(poolPath, "objects")),
-					os.ModePerm,
+					perm.PublicFile,
 				))
 
 				for _, path := range []string{repoPath, poolPath} {
@@ -269,7 +270,7 @@ func TestSize(t *testing.T) {
 				require.NoError(t, os.WriteFile(
 					filepath.Join(repoPath, "objects", "info", "alternates"),
 					[]byte(filepath.Join(poolPath, "objects")),
-					os.ModePerm,
+					perm.PublicFile,
 				))
 
 				// We write the same object into both repositories, so we should
@@ -304,7 +305,7 @@ func TestSize(t *testing.T) {
 				require.NoError(t, os.WriteFile(
 					filepath.Join(repoPath, "objects", "info", "alternates"),
 					[]byte(filepath.Join(poolPath, "objects")),
-					os.ModePerm,
+					perm.PublicFile,
 				))
 
 				for i, path := range []string{repoPath, poolPath} {
diff --git a/internal/git/objectpool/link_test.go b/internal/git/objectpool/link_test.go
index 2c691164c..eb8074dc7 100644
--- a/internal/git/objectpool/link_test.go
+++ b/internal/git/objectpool/link_test.go
@@ -12,6 +12,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/stats"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/transaction/txinfo"
 	"google.golang.org/grpc/peer"
@@ -117,7 +118,7 @@ func TestLink_absoluteLinkExists(t *testing.T) {
 	altPath, err := repo.InfoAlternatesPath()
 	require.NoError(t, err)
 
-	require.NoError(t, os.WriteFile(altPath, []byte(poolObjectsPath), 0o644))
+	require.NoError(t, os.WriteFile(altPath, []byte(poolObjectsPath), perm.SharedFile))
 
 	require.NoError(t, pool.Link(ctx, repo), "we expect this call to change the absolute link to a relative link")
 
diff --git a/internal/git/objectpool/pool_test.go b/internal/git/objectpool/pool_test.go
index 13e5b4798..57c1d6071 100644
--- a/internal/git/objectpool/pool_test.go
+++ b/internal/git/objectpool/pool_test.go
@@ -110,7 +110,7 @@ func TestFromRepo_failures(t *testing.T) {
 
 			require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "objects", "info"), perm.SharedDir))
 			alternateFilePath := filepath.Join(repoPath, "objects", "info", "alternates")
-			require.NoError(t, os.WriteFile(alternateFilePath, tc.fileContent, 0o644))
+			require.NoError(t, os.WriteFile(alternateFilePath, tc.fileContent, perm.SharedFile))
 			poolFromRepo, err := FromRepo(locator, pool.gitCmdFactory, nil, nil, nil, repo)
 			require.Equal(t, tc.expectedErr, err)
 			require.Nil(t, poolFromRepo)
diff --git a/internal/git/quarantine/quarantine_test.go b/internal/git/quarantine/quarantine_test.go
index 390bdf9e1..4d372fcc2 100644
--- a/internal/git/quarantine/quarantine_test.go
+++ b/internal/git/quarantine/quarantine_test.go
@@ -34,7 +34,7 @@ func (e entry) create(t *testing.T, root string) {
 			child.create(t, filepath.Join(root, name))
 		}
 	} else {
-		require.NoError(t, os.WriteFile(root, []byte(e.contents), 0o666))
+		require.NoError(t, os.WriteFile(root, []byte(e.contents), perm.PublicFile))
 	}
 }
 
@@ -122,7 +122,7 @@ func TestQuarantine_Migrate(t *testing.T) {
 		quarantine, err := New(ctx, repo, locator)
 		require.NoError(t, err)
 
-		require.NoError(t, os.WriteFile(filepath.Join(quarantine.dir.Path(), "file"), []byte("foobar"), 0o666))
+		require.NoError(t, os.WriteFile(filepath.Join(quarantine.dir.Path(), "file"), []byte("foobar"), perm.PublicFile))
 		require.NoError(t, quarantine.Migrate())
 
 		newContents := listEntries(t, repoPath)
@@ -337,7 +337,7 @@ func TestFinalizeObjectFile(t *testing.T) {
 
 		source := filepath.Join(dir, "a")
 		target := filepath.Join(dir, "b")
-		require.NoError(t, os.WriteFile(source, []byte("a"), 0o777))
+		require.NoError(t, os.WriteFile(source, []byte("a"), perm.PublicExecutable))
 
 		require.NoError(t, finalizeObjectFile(source, target))
 		require.NoFileExists(t, source)
@@ -350,7 +350,7 @@ func TestFinalizeObjectFile(t *testing.T) {
 
 		source := filepath.Join(sourceDir, "a")
 		target := filepath.Join(targetDir, "a")
-		require.NoError(t, os.WriteFile(source, []byte("a"), 0o777))
+		require.NoError(t, os.WriteFile(source, []byte("a"), perm.PublicExecutable))
 
 		require.NoError(t, finalizeObjectFile(source, target))
 		require.NoFileExists(t, source)
@@ -361,10 +361,10 @@ func TestFinalizeObjectFile(t *testing.T) {
 		dir := testhelper.TempDir(t)
 
 		source := filepath.Join(dir, "a")
-		require.NoError(t, os.WriteFile(source, []byte("a"), 0o777))
+		require.NoError(t, os.WriteFile(source, []byte("a"), perm.PublicExecutable))
 
 		target := filepath.Join(dir, "b")
-		require.NoError(t, os.WriteFile(target, []byte("b"), 0o777))
+		require.NoError(t, os.WriteFile(target, []byte("b"), perm.PublicExecutable))
 
 		// We do not expect an error in case the target file exists: given that objects and
 		// packs are content addressable, a file with the same name should have the same
diff --git a/internal/git/remoterepo/repository_test.go b/internal/git/remoterepo/repository_test.go
index b5dfa4616..f2e4865f9 100644
--- a/internal/git/remoterepo/repository_test.go
+++ b/internal/git/remoterepo/repository_test.go
@@ -14,6 +14,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/remoterepo"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/storage"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -113,7 +114,7 @@ func TestRepository_ObjectHash(t *testing.T) {
 						"[extensions]",
 						"objectFormat = blake2b",
 					}, "\n"),
-				), 0o644))
+				), perm.SharedFile))
 
 				repo, err := remoterepo.New(ctx, repoProto, pool)
 				require.NoError(t, err)
diff --git a/internal/git/ssh.go b/internal/git/ssh.go
index be411576f..93f312597 100644
--- a/internal/git/ssh.go
+++ b/internal/git/ssh.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 // BuildSSHInvocation builds a command line to invoke SSH with the provided key and known hosts.
@@ -32,7 +33,7 @@ func BuildSSHInvocation(ctx context.Context, sshKey, knownHosts string) (string,
 	args := []string{sshCommand}
 	if sshKey != "" {
 		sshKeyFile := filepath.Join(tmpDir, "ssh-key")
-		if err := os.WriteFile(sshKeyFile, []byte(sshKey), 0o400); err != nil {
+		if err := os.WriteFile(sshKeyFile, []byte(sshKey), perm.PrivateWriteOnceFile); err != nil {
 			cleanup()
 			return "", nil, fmt.Errorf("create ssh key file: %w", err)
 		}
@@ -42,7 +43,7 @@ func BuildSSHInvocation(ctx context.Context, sshKey, knownHosts string) (string,
 
 	if knownHosts != "" {
 		knownHostsFile := filepath.Join(tmpDir, "known-hosts")
-		if err := os.WriteFile(knownHostsFile, []byte(knownHosts), 0o400); err != nil {
+		if err := os.WriteFile(knownHostsFile, []byte(knownHosts), perm.PrivateWriteOnceFile); err != nil {
 			cleanup()
 			return "", nil, fmt.Errorf("create known hosts file: %w", err)
 		}
diff --git a/internal/git/stats/repository_info_test.go b/internal/git/stats/repository_info_test.go
index 3e11904f5..faafc1be2 100644
--- a/internal/git/stats/repository_info_test.go
+++ b/internal/git/stats/repository_info_test.go
@@ -257,7 +257,7 @@ func TestRepositoryInfoForRepository(t *testing.T) {
 			desc: "garbage",
 			setup: func(t *testing.T, repoPath string) {
 				garbagePath := filepath.Join(repoPath, "objects", "pack", "garbage")
-				require.NoError(t, os.WriteFile(garbagePath, []byte("x"), 0o600))
+				require.NoError(t, os.WriteFile(garbagePath, []byte("x"), perm.PrivateFile))
 			},
 			expectedInfo: RepositoryInfo{
 				Packfiles: PackfilesInfo{
@@ -270,7 +270,7 @@ func TestRepositoryInfoForRepository(t *testing.T) {
 			desc: "alternates",
 			setup: func(t *testing.T, repoPath string) {
 				infoAlternatesPath := filepath.Join(repoPath, "objects", "info", "alternates")
-				require.NoError(t, os.WriteFile(infoAlternatesPath, []byte(alternatePath), 0o600))
+				require.NoError(t, os.WriteFile(infoAlternatesPath, []byte(alternatePath), perm.PrivateFile))
 			},
 			expectedInfo: RepositoryInfo{
 				Alternates: []string{
@@ -355,7 +355,7 @@ func TestRepositoryInfoForRepository(t *testing.T) {
 			desc: "all together",
 			setup: func(t *testing.T, repoPath string) {
 				infoAlternatesPath := filepath.Join(repoPath, "objects", "info", "alternates")
-				require.NoError(t, os.WriteFile(infoAlternatesPath, []byte(alternatePath), 0o600))
+				require.NoError(t, os.WriteFile(infoAlternatesPath, []byte(alternatePath), perm.PrivateFile))
 
 				// We write a single packed blob.
 				blobID := gittest.WriteBlob(t, cfg, repoPath, []byte("x"))
@@ -370,7 +370,7 @@ func TestRepositoryInfoForRepository(t *testing.T) {
 				// everywhere.
 				for _, file := range []string{"garbage1", "garbage2", "garbage3"} {
 					garbagePath := filepath.Join(repoPath, "objects", "pack", file)
-					require.NoError(t, os.WriteFile(garbagePath, []byte("x"), 0o600))
+					require.NoError(t, os.WriteFile(garbagePath, []byte("x"), perm.PrivateFile))
 				}
 			},
 			expectedInfo: RepositoryInfo{
@@ -444,7 +444,7 @@ func TestReferencesInfoForRepository(t *testing.T) {
 				// We just write some random garbage -- we don't verify contents
 				// anyway, but just the size. And testing like that is at least
 				// deterministic as we don't have to special-case hash sizes.
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "packed-refs"), []byte("content"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "packed-refs"), []byte("content"), perm.SharedFile))
 			},
 			expectedInfo: ReferencesInfo{
 				PackedReferencesSize: 7,
@@ -464,7 +464,7 @@ func TestReferencesInfoForRepository(t *testing.T) {
 				// We just write some random garbage -- we don't verify contents
 				// anyway, but just the size. And testing like that is at least
 				// deterministic as we don't have to special-case hash sizes.
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "packed-refs"), []byte("content"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "packed-refs"), []byte("content"), perm.SharedFile))
 			},
 			expectedInfo: ReferencesInfo{
 				LooseReferencesCount: 3,
@@ -515,7 +515,7 @@ func TestCountLooseObjects(t *testing.T) {
 
 		differentShard := filepath.Join(repoPath, "objects", "a0")
 		require.NoError(t, os.MkdirAll(differentShard, perm.SharedDir))
-		require.NoError(t, os.WriteFile(filepath.Join(differentShard, "123456"), []byte("foobar"), 0o644))
+		require.NoError(t, os.WriteFile(filepath.Join(differentShard, "123456"), []byte("foobar"), perm.SharedFile))
 
 		requireLooseObjectsInfo(t, repo, time.Now(), LooseObjectsInfo{
 			Count:      1,
@@ -531,7 +531,7 @@ func TestCountLooseObjects(t *testing.T) {
 		for i, shard := range []string{"00", "17", "32", "ff"} {
 			shardPath := filepath.Join(repoPath, "objects", shard)
 			require.NoError(t, os.MkdirAll(shardPath, perm.SharedDir))
-			require.NoError(t, os.WriteFile(filepath.Join(shardPath, "123456"), make([]byte, i), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(shardPath, "123456"), make([]byte, i), perm.SharedFile))
 		}
 
 		requireLooseObjectsInfo(t, repo, time.Now(), LooseObjectsInfo{
@@ -558,7 +558,7 @@ func TestCountLooseObjects(t *testing.T) {
 		beforeCutoffDate := cutoffDate.Add(-1 * time.Minute)
 
 		for _, objectPath := range objectPaths {
-			require.NoError(t, os.WriteFile(objectPath, []byte("1"), 0o644))
+			require.NoError(t, os.WriteFile(objectPath, []byte("1"), perm.SharedFile))
 			require.NoError(t, os.Chtimes(objectPath, afterCutoffDate, afterCutoffDate))
 		}
 
@@ -587,8 +587,8 @@ func TestCountLooseObjects(t *testing.T) {
 		shard := filepath.Join(repoPath, "objects", "17")
 		require.NoError(t, os.MkdirAll(shard, perm.SharedDir))
 
-		require.NoError(t, os.WriteFile(filepath.Join(shard, "012345"), []byte("valid"), 0o644))
-		require.NoError(t, os.WriteFile(filepath.Join(shard, "garbage"), []byte("garbage"), 0o644))
+		require.NoError(t, os.WriteFile(filepath.Join(shard, "012345"), []byte("valid"), perm.SharedFile))
+		require.NoError(t, os.WriteFile(filepath.Join(shard, "garbage"), []byte("garbage"), perm.SharedFile))
 
 		requireLooseObjectsInfo(t, repo, time.Now(), LooseObjectsInfo{
 			Count:        1,
@@ -627,7 +627,7 @@ func BenchmarkCountLooseObjects(b *testing.B) {
 
 		objectPath := filepath.Join(repoPath, "objects", "17", "12345")
 		require.NoError(b, os.Mkdir(filepath.Dir(objectPath), perm.SharedDir))
-		require.NoError(b, os.WriteFile(objectPath, nil, 0o644))
+		require.NoError(b, os.WriteFile(objectPath, nil, perm.SharedFile))
 
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
@@ -642,7 +642,7 @@ func BenchmarkCountLooseObjects(b *testing.B) {
 		for i := 0; i < 256; i++ {
 			objectPath := filepath.Join(repoPath, "objects", fmt.Sprintf("%02x", i), "12345")
 			require.NoError(b, os.Mkdir(filepath.Dir(objectPath), perm.SharedDir))
-			require.NoError(b, os.WriteFile(objectPath, nil, 0o644))
+			require.NoError(b, os.WriteFile(objectPath, nil, perm.SharedFile))
 		}
 
 		b.ResetTimer()
@@ -671,7 +671,7 @@ func BenchmarkCountLooseObjects(b *testing.B) {
 
 			for j := 0; j < looseObjectCount; j++ {
 				objectPath := filepath.Join(shardPath, fmt.Sprintf("%d", j))
-				require.NoError(b, os.WriteFile(objectPath, nil, 0o644))
+				require.NoError(b, os.WriteFile(objectPath, nil, perm.SharedFile))
 			}
 		}
 
@@ -691,7 +691,7 @@ func BenchmarkCountLooseObjects(b *testing.B) {
 
 			for j := 0; j < 1000; j++ {
 				objectPath := filepath.Join(shardPath, fmt.Sprintf("%d", j))
-				require.NoError(b, os.WriteFile(objectPath, nil, 0o644))
+				require.NoError(b, os.WriteFile(objectPath, nil, perm.SharedFile))
 			}
 		}
 
@@ -725,7 +725,7 @@ func TestPackfileInfoForRepository(t *testing.T) {
 			seedRepository: func(t *testing.T, repoPath string) {
 				packfileDir := filepath.Join(repoPath, "objects", "pack")
 				require.NoError(t, os.MkdirAll(packfileDir, perm.SharedDir))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), perm.SharedFile))
 			},
 			expectedInfo: PackfilesInfo{
 				Count: 1,
@@ -737,8 +737,8 @@ func TestPackfileInfoForRepository(t *testing.T) {
 			seedRepository: func(t *testing.T, repoPath string) {
 				packfileDir := filepath.Join(repoPath, "objects", "pack")
 				require.NoError(t, os.MkdirAll(packfileDir, perm.SharedDir))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), 0o644))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.keep"), []byte("foobar"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), perm.SharedFile))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.keep"), []byte("foobar"), perm.SharedFile))
 			},
 			expectedInfo: PackfilesInfo{
 				KeepCount: 1,
@@ -750,8 +750,8 @@ func TestPackfileInfoForRepository(t *testing.T) {
 			seedRepository: func(t *testing.T, repoPath string) {
 				packfileDir := filepath.Join(repoPath, "objects", "pack")
 				require.NoError(t, os.MkdirAll(packfileDir, perm.SharedDir))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), 0o644))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.mtimes"), []byte("foobar"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), perm.SharedFile))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.mtimes"), []byte("foobar"), perm.SharedFile))
 			},
 			expectedInfo: PackfilesInfo{
 				CruftCount: 1,
@@ -763,8 +763,8 @@ func TestPackfileInfoForRepository(t *testing.T) {
 			seedRepository: func(t *testing.T, repoPath string) {
 				packfileDir := filepath.Join(repoPath, "objects", "pack")
 				require.NoError(t, os.MkdirAll(packfileDir, perm.SharedDir))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), 0o644))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-bar.pack"), []byte("123"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-foo.pack"), []byte("foobar"), perm.SharedFile))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "pack-bar.pack"), []byte("123"), perm.SharedFile))
 			},
 			expectedInfo: PackfilesInfo{
 				Count: 2,
@@ -793,7 +793,7 @@ func TestPackfileInfoForRepository(t *testing.T) {
 			seedRepository: func(t *testing.T, repoPath string) {
 				packfileDir := filepath.Join(repoPath, "objects", "pack")
 				require.NoError(t, os.MkdirAll(packfileDir, perm.SharedDir))
-				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "multi-pack-index"), nil, 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(packfileDir, "multi-pack-index"), nil, perm.SharedFile))
 			},
 			expectedInfo: PackfilesInfo{
 				HasMultiPackIndex: true,
@@ -824,7 +824,7 @@ func TestPackfileInfoForRepository(t *testing.T) {
 				gittest.WriteCommit(t, cfg, repoPath, gittest.WithMessage("second"), gittest.WithBranch("second"))
 				gittest.Exec(t, cfg, "-C", repoPath, "repack", "-db", "--write-midx")
 
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "objects", "pack", "garbage"), []byte("1"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "objects", "pack", "garbage"), []byte("1"), perm.SharedFile))
 			},
 			expectedInfo: PackfilesInfo{
 				Count:             2,
@@ -1139,7 +1139,7 @@ func TestBitmapInfoForPath(t *testing.T) {
 			desc: "header is too short",
 			setup: func(t *testing.T) string {
 				bitmapPath := filepath.Join(testhelper.TempDir(t), "bitmap")
-				require.NoError(t, os.WriteFile(bitmapPath, []byte{0, 0, 0}, 0o644))
+				require.NoError(t, os.WriteFile(bitmapPath, []byte{0, 0, 0}, perm.SharedFile))
 				return bitmapPath
 			},
 			expectedErr: fmt.Errorf("reading bitmap header: %w", io.ErrUnexpectedEOF),
@@ -1150,7 +1150,7 @@ func TestBitmapInfoForPath(t *testing.T) {
 				bitmapPath := filepath.Join(testhelper.TempDir(t), "bitmap")
 				require.NoError(t, os.WriteFile(bitmapPath, []byte{
 					'B', 'I', 'T', 'O', 0, 0, 0, 0,
-				}, 0o644))
+				}, perm.SharedFile))
 				return bitmapPath
 			},
 			expectedErr: fmt.Errorf("invalid bitmap signature: %q", "BITO"),
@@ -1161,7 +1161,7 @@ func TestBitmapInfoForPath(t *testing.T) {
 				bitmapPath := filepath.Join(testhelper.TempDir(t), "bitmap")
 				require.NoError(t, os.WriteFile(bitmapPath, []byte{
 					'B', 'I', 'T', 'M', 0, 2, 0, 0,
-				}, 0o644))
+				}, perm.SharedFile))
 				return bitmapPath
 			},
 			expectedErr: fmt.Errorf("unsupported version: 2"),
diff --git a/internal/gitaly/config/config_test.go b/internal/gitaly/config/config_test.go
index 3f3a3e05b..c6bb4d32a 100644
--- a/internal/gitaly/config/config_test.go
+++ b/internal/gitaly/config/config_test.go
@@ -185,7 +185,7 @@ func TestValidateStorages(t *testing.T) {
 	require.NoError(t, os.MkdirAll(nestedRepositories, perm.PublicDir))
 
 	filePath := filepath.Join(testhelper.TempDir(t), "temporary-file")
-	require.NoError(t, os.WriteFile(filePath, []byte{}, 0o666))
+	require.NoError(t, os.WriteFile(filePath, []byte{}, perm.PublicFile))
 
 	invalidDir := filepath.Join(repositories, t.Name())
 
@@ -427,7 +427,7 @@ func TestValidateShellPath(t *testing.T) {
 
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpDir, "bin"), perm.SharedDir))
 	tmpFile := filepath.Join(tmpDir, "my-file")
-	require.NoError(t, os.WriteFile(tmpFile, []byte{}, 0o666))
+	require.NoError(t, os.WriteFile(tmpFile, []byte{}, perm.PublicFile))
 
 	testCases := []struct {
 		desc      string
@@ -473,7 +473,7 @@ func TestConfigureRuby(t *testing.T) {
 	tmpDir := testhelper.TempDir(t)
 
 	tmpFile := filepath.Join(tmpDir, "file")
-	require.NoError(t, os.WriteFile(tmpFile, nil, 0o644))
+	require.NoError(t, os.WriteFile(tmpFile, nil, perm.SharedFile))
 
 	testCases := []struct {
 		desc      string
@@ -1264,7 +1264,7 @@ func TestSetupRuntimeDirectory(t *testing.T) {
 	t.Run("validation", func(t *testing.T) {
 		dirPath := testhelper.TempDir(t)
 		filePath := filepath.Join(dirPath, "file")
-		require.NoError(t, os.WriteFile(filePath, nil, 0o644))
+		require.NoError(t, os.WriteFile(filePath, nil, perm.SharedFile))
 
 		for _, tc := range []struct {
 			desc        string
diff --git a/internal/gitaly/config/temp_dir_test.go b/internal/gitaly/config/temp_dir_test.go
index 2e809363a..62b188776 100644
--- a/internal/gitaly/config/temp_dir_test.go
+++ b/internal/gitaly/config/temp_dir_test.go
@@ -62,7 +62,7 @@ func TestPruneOldGitalyProcessDirectories(t *testing.T) {
 
 		// Create an unexpected file in the runtime directory
 		unexpectedFilePath := filepath.Join(baseDir, "unexpected-file")
-		require.NoError(t, os.WriteFile(unexpectedFilePath, []byte(""), os.ModePerm))
+		require.NoError(t, os.WriteFile(unexpectedFilePath, []byte(""), perm.PublicFile))
 		expectedLogs[unexpectedFilePath] = "ignoring file found in gitaly process directory"
 
 		nonPrunableDirs := []string{ownRuntimeDir}
diff --git a/internal/gitaly/hook/custom_test.go b/internal/gitaly/hook/custom_test.go
index 6f109998b..52febe6bb 100644
--- a/internal/gitaly/hook/custom_test.go
+++ b/internal/gitaly/hook/custom_test.go
@@ -445,7 +445,7 @@ type customHookResults struct {
 
 func writeCustomHook(t *testing.T, hookName, dir string, content []byte) func() {
 	require.NoError(t, os.MkdirAll(dir, perm.SharedDir))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, hookName), content, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, hookName), content, perm.SharedExecutable))
 
 	return func() {
 		require.NoError(t, os.RemoveAll(dir))
diff --git a/internal/gitaly/linguist/language_stats_test.go b/internal/gitaly/linguist/language_stats_test.go
index 74f66a568..fa296e4bf 100644
--- a/internal/gitaly/linguist/language_stats_test.go
+++ b/internal/gitaly/linguist/language_stats_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
 )
@@ -49,7 +50,7 @@ func TestInitLanguageStats(t *testing.T) {
 		{
 			desc: "corrupt cache",
 			run: func(t *testing.T, repo *localrepo.Repo, repoPath string) {
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, languageStatsFilename), []byte("garbage"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, languageStatsFilename), []byte("garbage"), perm.SharedFile))
 
 				stats, err := initLanguageStats(repo)
 				require.Errorf(t, err, "new language stats zlib reader: invalid header")
@@ -67,7 +68,7 @@ func TestInitLanguageStats(t *testing.T) {
 				stats.Version = "faulty"
 
 				// Copy save() behavior, but with a faulty version
-				file, err := os.OpenFile(filepath.Join(repoPath, languageStatsFilename), os.O_WRONLY|os.O_CREATE, 0o755)
+				file, err := os.OpenFile(filepath.Join(repoPath, languageStatsFilename), os.O_WRONLY|os.O_CREATE, perm.SharedExecutable)
 				require.NoError(t, err)
 				w := zlib.NewWriter(file)
 				require.NoError(t, json.NewEncoder(w).Encode(stats))
diff --git a/internal/gitaly/linguist/linguist_test.go b/internal/gitaly/linguist/linguist_test.go
index 1fd1bb633..6de1d52fe 100644
--- a/internal/gitaly/linguist/linguist_test.go
+++ b/internal/gitaly/linguist/linguist_test.go
@@ -460,7 +460,7 @@ func TestInstance_Stats(t *testing.T) {
 					gittest.TreeEntry{Path: "application.rb", Mode: "100644", Content: strings.Repeat("a", 2943)},
 				))
 
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, languageStatsFilename), []byte("garbage"), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, languageStatsFilename), []byte("garbage"), perm.SharedFile))
 
 				return repoProto, repoPath, commitID
 			},
@@ -532,7 +532,7 @@ func TestInstance_Stats(t *testing.T) {
 			require.NoError(t, os.MkdirAll(infoPath, perm.SharedDir))
 			attrData, err := gittest.NewCommand(t, cfg, "-C", repoPath, "cat-file", "blob", objectID.String()+":.gitattributes").Output()
 			if err == nil {
-				require.NoError(t, os.WriteFile(filepath.Join(infoPath, "attributes"), attrData, 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(infoPath, "attributes"), attrData, perm.SharedFile))
 			}
 
 			repo := localrepo.NewTestRepo(t, cfg, repoProto)
diff --git a/internal/gitaly/maintenance/randomwalker_test.go b/internal/gitaly/maintenance/randomwalker_test.go
index 0b6a8e7bf..22f406572 100644
--- a/internal/gitaly/maintenance/randomwalker_test.go
+++ b/internal/gitaly/maintenance/randomwalker_test.go
@@ -156,7 +156,7 @@ func TestRandomWalk(t *testing.T) {
 			}
 
 			for _, file := range tc.files {
-				require.NoError(t, os.WriteFile(filepath.Join(root, file), []byte{}, 0o777))
+				require.NoError(t, os.WriteFile(filepath.Join(root, file), []byte{}, perm.PublicExecutable))
 			}
 
 			walker := newRandomWalker(root, rand.New(rand.NewSource(1)))
diff --git a/internal/gitaly/repoutil/create_test.go b/internal/gitaly/repoutil/create_test.go
index 838970617..97e2fbb07 100644
--- a/internal/gitaly/repoutil/create_test.go
+++ b/internal/gitaly/repoutil/create_test.go
@@ -219,14 +219,14 @@ func TestCreate(t *testing.T) {
 				// indeterministic data that's different across replicas and would
 				// thus cause us to not reach quorum.
 				require.NoError(t, os.Mkdir(filepath.Join(repoPath, "objects"), perm.PublicDir))
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "objects", "object"), []byte("object"), 0o666))
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "FETCH_HEAD"), []byte("fetch-head"), 0o666))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "objects", "object"), []byte("object"), perm.PublicFile))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "FETCH_HEAD"), []byte("fetch-head"), perm.PublicFile))
 
 				// All the other files should be hashed though.
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "HEAD"), []byte("head"), 0o666))
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "config"), []byte("cfg"), 0o666))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "HEAD"), []byte("head"), perm.PublicFile))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "config"), []byte("cfg"), perm.PublicFile))
 				require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "refs", "heads"), perm.PublicDir))
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "refs", "heads", "foo"), []byte("foo"), 0o666))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "refs", "heads", "foo"), []byte("foo"), perm.PublicFile))
 
 				return nil
 			},
diff --git a/internal/gitaly/rubyserver/rubyserver.go b/internal/gitaly/rubyserver/rubyserver.go
index 34f3e80c6..d047f8707 100644
--- a/internal/gitaly/rubyserver/rubyserver.go
+++ b/internal/gitaly/rubyserver/rubyserver.go
@@ -162,7 +162,7 @@ func (s *Server) start() error {
 		// Git configuration. Otherwise, Rugged wouldn't find it.
 		if err := os.WriteFile(filepath.Join(gitconfigDir, "gitconfig"), []byte(
 			"[core]\n\tfsyncObjectFiles = true\n",
-		), 0o666); err != nil {
+		), perm.PublicFile); err != nil {
 			return fmt.Errorf("writing gitconfig: %w", err)
 		}
 
diff --git a/internal/gitaly/rubyserver/rubyserver_test.go b/internal/gitaly/rubyserver/rubyserver_test.go
index a52e3f4fb..15e0c905d 100644
--- a/internal/gitaly/rubyserver/rubyserver_test.go
+++ b/internal/gitaly/rubyserver/rubyserver_test.go
@@ -16,6 +16,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config/log"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/storage"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/version"
@@ -171,7 +172,7 @@ func TestServer_gitconfig(t *testing.T) {
 			setup: func(t *testing.T) (config.Cfg, string) {
 				gitconfigDir := testhelper.TempDir(t)
 				expectedPath := filepath.Join(gitconfigDir, "gitconfig")
-				require.NoError(t, os.WriteFile(expectedPath, []byte("garbage"), 0o666))
+				require.NoError(t, os.WriteFile(expectedPath, []byte("garbage"), perm.PublicFile))
 
 				cfg := testcfg.Build(t, testcfg.WithBase(config.Cfg{
 					Ruby: config.Ruby{
diff --git a/internal/gitaly/service/conflicts/resolve_conflicts_test.go b/internal/gitaly/service/conflicts/resolve_conflicts_test.go
index 5efe7f6b9..948880ab5 100644
--- a/internal/gitaly/service/conflicts/resolve_conflicts_test.go
+++ b/internal/gitaly/service/conflicts/resolve_conflicts_test.go
@@ -20,6 +20,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/hook"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -474,7 +475,7 @@ func TestResolveConflictsIdenticalContent(t *testing.T) {
 	} {
 		contents := gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-p", rev+":files/ruby/popen.rb")
 		path := filepath.Join(tempDir, rev)
-		require.NoError(t, os.WriteFile(path, contents, 0o644))
+		require.NoError(t, os.WriteFile(path, contents, perm.SharedFile))
 		conflictingPaths = append(conflictingPaths, path)
 	}
 
diff --git a/internal/gitaly/service/objectpool/alternates_test.go b/internal/gitaly/service/objectpool/alternates_test.go
index 8b9a9205c..99687d6c5 100644
--- a/internal/gitaly/service/objectpool/alternates_test.go
+++ b/internal/gitaly/service/objectpool/alternates_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -115,7 +116,7 @@ func testDisconnectGitAlternatesUnexpectedAlternates(t *testing.T, ctx context.C
 
 			altPath, err := repo.InfoAlternatesPath()
 			require.NoError(t, err)
-			require.NoError(t, os.WriteFile(altPath, []byte(tc.altContent), 0o644))
+			require.NoError(t, os.WriteFile(altPath, []byte(tc.altContent), perm.SharedFile))
 
 			_, err = client.DisconnectGitAlternates(ctx, &gitalypb.DisconnectGitAlternatesRequest{Repository: repoProto})
 			require.Error(t, err)
@@ -149,7 +150,7 @@ func testRemoveAlternatesIfOk(t *testing.T, ctx context.Context) {
 		altPath, err := repo.InfoAlternatesPath()
 		require.NoError(t, err)
 		altContent := testhelper.TempDir(t) + "\n"
-		require.NoError(t, os.WriteFile(altPath, []byte(altContent), 0o644))
+		require.NoError(t, os.WriteFile(altPath, []byte(altContent), perm.SharedFile))
 
 		// Intentionally break the repository so that the consistency check will cause an
 		// error.
@@ -177,7 +178,7 @@ func testRemoveAlternatesIfOk(t *testing.T, ctx context.Context) {
 		altPath, err := repo.InfoAlternatesPath()
 		require.NoError(t, err)
 		altContent := testhelper.TempDir(t) + "\n"
-		require.NoError(t, os.WriteFile(altPath, []byte(altContent), 0o644))
+		require.NoError(t, os.WriteFile(altPath, []byte(altContent), perm.SharedFile))
 
 		// In order to test the scenario where a commit is in a commit graph but not in the
 		// object database, we will first write a new commit, write the commit graph, then
diff --git a/internal/gitaly/service/objectpool/create_test.go b/internal/gitaly/service/objectpool/create_test.go
index b4dba6096..edad5de8a 100644
--- a/internal/gitaly/service/objectpool/create_test.go
+++ b/internal/gitaly/service/objectpool/create_test.go
@@ -90,7 +90,7 @@ func TestCreate_unsuccessful(t *testing.T) {
 	lockedRelativePath := gittest.NewObjectPoolName(t)
 	lockedFullPath := filepath.Join(cfg.Storages[0].Path, lockedRelativePath+".lock")
 	require.NoError(t, os.MkdirAll(filepath.Dir(lockedFullPath), perm.SharedDir))
-	require.NoError(t, os.WriteFile(lockedFullPath, nil, 0o644))
+	require.NoError(t, os.WriteFile(lockedFullPath, nil, perm.SharedFile))
 
 	// Create a preexisting object pool.
 	preexistingPool := &gitalypb.ObjectPool{
diff --git a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
index 1e73ef205..5c25adbeb 100644
--- a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
+++ b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
@@ -82,7 +82,7 @@ func testFetchIntoObjectPoolSuccess(t *testing.T, ctx context.Context) {
 	// references though and thus be able to recover.
 	brokenRef := filepath.Join(poolPath, "refs", "heads", "broken")
 	require.NoError(t, os.MkdirAll(filepath.Dir(brokenRef), perm.SharedDir))
-	require.NoError(t, os.WriteFile(brokenRef, []byte{}, 0o777))
+	require.NoError(t, os.WriteFile(brokenRef, []byte{}, perm.PublicExecutable))
 	oldTime := time.Now().Add(-25 * time.Hour)
 	require.NoError(t, os.Chtimes(brokenRef, oldTime, oldTime))
 
diff --git a/internal/gitaly/service/objectpool/get_test.go b/internal/gitaly/service/objectpool/get_test.go
index c9789a607..aef3df684 100644
--- a/internal/gitaly/service/objectpool/get_test.go
+++ b/internal/gitaly/service/objectpool/get_test.go
@@ -57,7 +57,7 @@ func TestGetObjectPoolBadFile(t *testing.T) {
 
 	alternatesFilePath := filepath.Join(repoPath, "objects", "info", "alternates")
 	require.NoError(t, os.MkdirAll(filepath.Dir(alternatesFilePath), perm.SharedDir))
-	require.NoError(t, os.WriteFile(alternatesFilePath, []byte("not-a-directory"), 0o644))
+	require.NoError(t, os.WriteFile(alternatesFilePath, []byte("not-a-directory"), perm.SharedFile))
 
 	resp, err := client.GetObjectPool(ctx, &gitalypb.GetObjectPoolRequest{
 		Repository: repo,
diff --git a/internal/gitaly/service/objectpool/link_test.go b/internal/gitaly/service/objectpool/link_test.go
index b1f453450..aeb75de38 100644
--- a/internal/gitaly/service/objectpool/link_test.go
+++ b/internal/gitaly/service/objectpool/link_test.go
@@ -11,6 +11,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testserver"
@@ -106,7 +107,7 @@ func TestLink_noClobber(t *testing.T) {
 	require.NoFileExists(t, alternatesFile)
 
 	contentBefore := "mock/objects\n"
-	require.NoError(t, os.WriteFile(alternatesFile, []byte(contentBefore), 0o644))
+	require.NoError(t, os.WriteFile(alternatesFile, []byte(contentBefore), perm.SharedFile))
 
 	request := &gitalypb.LinkRepositoryToObjectPoolRequest{
 		Repository: repoProto,
diff --git a/internal/gitaly/service/repository/apply_gitattributes.go b/internal/gitaly/service/repository/apply_gitattributes.go
index 6b10b13aa..79a12259a 100644
--- a/internal/gitaly/service/repository/apply_gitattributes.go
+++ b/internal/gitaly/service/repository/apply_gitattributes.go
@@ -22,7 +22,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
 )
 
-const attributesFileMode os.FileMode = 0o644
+const attributesFileMode os.FileMode = perm.SharedFile
 
 func (s *server) applyGitattributes(ctx context.Context, repo *localrepo.Repo, objectReader catfile.ObjectContentReader, repoPath string, revision []byte) (returnedErr error) {
 	infoPath := filepath.Join(repoPath, "info")
diff --git a/internal/gitaly/service/repository/apply_gitattributes_test.go b/internal/gitaly/service/repository/apply_gitattributes_test.go
index 0eeb7ecb5..227d8e36e 100644
--- a/internal/gitaly/service/repository/apply_gitattributes_test.go
+++ b/internal/gitaly/service/repository/apply_gitattributes_test.go
@@ -69,7 +69,7 @@ func TestApplyGitattributes_successful(t *testing.T) {
 			t.Run("with preexisting 'info/attributes'", func(t *testing.T) {
 				require.NoError(t, os.RemoveAll(infoPath))
 				require.NoError(t, os.Mkdir(infoPath, perm.SharedDir))
-				require.NoError(t, os.WriteFile(attributesPath, []byte("*.docx diff=word"), 0o644))
+				require.NoError(t, os.WriteFile(attributesPath, []byte("*.docx diff=word"), perm.SharedFile))
 				requireApplyGitattributes(t, ctx, client, repo, attributesPath, tc.revision, tc.expectedContent)
 			})
 		})
diff --git a/internal/gitaly/service/repository/archive_test.go b/internal/gitaly/service/repository/archive_test.go
index fa1c1a1aa..e48111ac0 100644
--- a/internal/gitaly/service/repository/archive_test.go
+++ b/internal/gitaly/service/repository/archive_test.go
@@ -18,6 +18,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/smudge"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitlab"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
@@ -551,7 +552,7 @@ func TestGetArchive_environment(t *testing.T) {
 
 func compressedFileContents(t *testing.T, format gitalypb.GetArchiveRequest_Format, contents []byte) string {
 	path := filepath.Join(testhelper.TempDir(t), "archive")
-	require.NoError(t, os.WriteFile(path, contents, 0o644))
+	require.NoError(t, os.WriteFile(path, contents, perm.SharedFile))
 
 	switch format {
 	case gitalypb.GetArchiveRequest_TAR:
diff --git a/internal/gitaly/service/repository/backup_custom_hooks_test.go b/internal/gitaly/service/repository/backup_custom_hooks_test.go
index 9c897bcd2..62d42ddbc 100644
--- a/internal/gitaly/service/repository/backup_custom_hooks_test.go
+++ b/internal/gitaly/service/repository/backup_custom_hooks_test.go
@@ -36,7 +36,7 @@ func TestBackupCustomHooks_successful(t *testing.T) {
 	}
 	require.NoError(t, os.Mkdir(filepath.Join(repoPath, "custom_hooks"), perm.PrivateDir), "Could not create custom_hooks dir")
 	for _, fileName := range expectedTarResponse[1:] {
-		require.NoError(t, os.WriteFile(filepath.Join(repoPath, fileName), []byte("Some hooks"), 0o700), fmt.Sprintf("Could not create %s", fileName))
+		require.NoError(t, os.WriteFile(filepath.Join(repoPath, fileName), []byte("Some hooks"), perm.PrivateExecutable), fmt.Sprintf("Could not create %s", fileName))
 	}
 
 	backupRequest := &gitalypb.BackupCustomHooksRequest{Repository: repo}
diff --git a/internal/gitaly/service/repository/create_fork_test.go b/internal/gitaly/service/repository/create_fork_test.go
index 9b40586b3..cb936e263 100644
--- a/internal/gitaly/service/repository/create_fork_test.go
+++ b/internal/gitaly/service/repository/create_fork_test.go
@@ -244,7 +244,7 @@ func TestCreateFork_targetExists(t *testing.T) {
 				require.NoError(t, os.WriteFile(
 					filepath.Join(targetPath, "config"),
 					nil,
-					0o644,
+					perm.SharedFile,
 				))
 			},
 			expectedErrWithAtomicCreation: structerr.NewAlreadyExists("creating fork: repository exists already"),
@@ -253,7 +253,7 @@ func TestCreateFork_targetExists(t *testing.T) {
 			desc: "target file",
 			seed: func(t *testing.T, targetPath string) {
 				require.NoError(t, os.MkdirAll(filepath.Dir(targetPath), perm.GroupPrivateDir))
-				require.NoError(t, os.WriteFile(targetPath, nil, 0o644))
+				require.NoError(t, os.WriteFile(targetPath, nil, perm.SharedFile))
 			},
 			expectedErrWithAtomicCreation: structerr.NewAlreadyExists("creating fork: repository exists already"),
 		},
diff --git a/internal/gitaly/service/repository/create_repository_from_url_test.go b/internal/gitaly/service/repository/create_repository_from_url_test.go
index d06eec7ae..63df6ae02 100644
--- a/internal/gitaly/service/repository/create_repository_from_url_test.go
+++ b/internal/gitaly/service/repository/create_repository_from_url_test.go
@@ -134,7 +134,7 @@ func TestCreateRepositoryFromURL_existingTarget(t *testing.T) {
 				require.NoError(t, os.MkdirAll(importedRepoPath, perm.GroupPrivateDir))
 			} else {
 				require.NoError(t, os.MkdirAll(filepath.Dir(importedRepoPath), perm.PublicDir))
-				require.NoError(t, os.WriteFile(importedRepoPath, nil, 0o644))
+				require.NoError(t, os.WriteFile(importedRepoPath, nil, perm.SharedFile))
 			}
 			t.Cleanup(func() { require.NoError(t, os.RemoveAll(importedRepoPath)) })
 
diff --git a/internal/gitaly/service/repository/fetch_remote_test.go b/internal/gitaly/service/repository/fetch_remote_test.go
index 36c596379..22d52137c 100644
--- a/internal/gitaly/service/repository/fetch_remote_test.go
+++ b/internal/gitaly/service/repository/fetch_remote_test.go
@@ -15,6 +15,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
@@ -1121,7 +1122,7 @@ func TestFetchRemote_pooledRepository(t *testing.T) {
 			// Create the pooled repository and link it to its pool. This is the
 			// repository we're fetching into.
 			pooledRepoProto, pooledRepoPath := gittest.CreateRepository(t, ctx, cfg)
-			require.NoError(t, os.WriteFile(filepath.Join(pooledRepoPath, "objects", "info", "alternates"), []byte(filepath.Join(poolRepoPath, "objects")), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(pooledRepoPath, "objects", "info", "alternates"), []byte(filepath.Join(poolRepoPath, "objects")), perm.SharedFile))
 
 			// And then finally create a third repository that emulates the remote side
 			// we're fetching from. We need to create at least one reference so that Git
diff --git a/internal/gitaly/service/repository/fsck_test.go b/internal/gitaly/service/repository/fsck_test.go
index 6bf337388..bbaf8e617 100644
--- a/internal/gitaly/service/repository/fsck_test.go
+++ b/internal/gitaly/service/repository/fsck_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -77,7 +78,7 @@ func TestFsck(t *testing.T) {
 				// This makes the repo severely broken so that `git` does not
 				// identify it as a proper repository anymore.
 				require.NoError(t, os.RemoveAll(filepath.Join(repoPath, "objects")))
-				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "objects"), nil, 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(repoPath, "objects"), nil, perm.SharedFile))
 
 				return setupData{
 					repo: repo,
diff --git a/internal/gitaly/service/repository/gc_test.go b/internal/gitaly/service/repository/gc_test.go
index 97ea88b17..b6fe71cee 100644
--- a/internal/gitaly/service/repository/gc_test.go
+++ b/internal/gitaly/service/repository/gc_test.go
@@ -557,11 +557,11 @@ func testCleanupInvalidKeepAroundRefs(t *testing.T, ctx context.Context) {
 			// Create an invalid ref that should should be removed with the testcase
 			bogusSha := "b3f5e4adf6277b571b7943a4f0405a6dd7ee7e15"
 			bogusPath := filepath.Join(repoPath, fmt.Sprintf("refs/keep-around/%s", bogusSha))
-			require.NoError(t, os.WriteFile(bogusPath, []byte(bogusSha), 0o644))
+			require.NoError(t, os.WriteFile(bogusPath, []byte(bogusSha), perm.SharedFile))
 
 			// Creating the keeparound without using git so we can create invalid ones in testcases
 			refPath := filepath.Join(repoPath, fmt.Sprintf("refs/keep-around/%s", testcase.refName))
-			require.NoError(t, os.WriteFile(refPath, []byte(testcase.refContent), 0o644))
+			require.NoError(t, os.WriteFile(refPath, []byte(testcase.refContent), perm.SharedFile))
 
 			// Perform the request
 			req := &gitalypb.GarbageCollectRequest{Repository: repo}
@@ -591,7 +591,7 @@ func mustCreateFileWithTimes(tb testing.TB, path string, mTime time.Time) {
 	tb.Helper()
 
 	require.NoError(tb, os.MkdirAll(filepath.Dir(path), perm.SharedDir))
-	require.NoError(tb, os.WriteFile(path, nil, 0o644))
+	require.NoError(tb, os.WriteFile(path, nil, perm.SharedFile))
 	require.NoError(tb, os.Chtimes(path, mTime, mTime))
 }
 
diff --git a/internal/gitaly/service/repository/info_attributes_test.go b/internal/gitaly/service/repository/info_attributes_test.go
index 7c5ea034d..d8fe03690 100644
--- a/internal/gitaly/service/repository/info_attributes_test.go
+++ b/internal/gitaly/service/repository/info_attributes_test.go
@@ -30,7 +30,7 @@ func TestGetInfoAttributesExisting(t *testing.T) {
 	buffSize := streamio.WriteBufferSize + 1
 	data := bytes.Repeat([]byte("*.pbxproj binary\n"), buffSize)
 	attrsPath := filepath.Join(infoPath, "attributes")
-	err := os.WriteFile(attrsPath, data, 0o644)
+	err := os.WriteFile(attrsPath, data, perm.SharedFile)
 	require.NoError(t, err)
 
 	request := &gitalypb.GetInfoAttributesRequest{Repository: repo}
diff --git a/internal/gitaly/service/repository/midx_test.go b/internal/gitaly/service/repository/midx_test.go
index ce5fc108f..5d7e15c4e 100644
--- a/internal/gitaly/service/repository/midx_test.go
+++ b/internal/gitaly/service/repository/midx_test.go
@@ -23,6 +23,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/stats"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
@@ -64,7 +65,7 @@ func TestMidxRewrite(t *testing.T) {
 
 	// Create an invalid multi-pack-index file
 	// with mtime update being the basis for comparison
-	require.NoError(t, os.WriteFile(midxPath, nil, 0o644))
+	require.NoError(t, os.WriteFile(midxPath, nil, perm.SharedFile))
 	require.NoError(t, os.Chtimes(midxPath, time.Time{}, time.Time{}))
 	info, err := os.Stat(midxPath)
 	require.NoError(t, err)
diff --git a/internal/gitaly/service/repository/object_format_test.go b/internal/gitaly/service/repository/object_format_test.go
index 2cc8e738a..80d41c36f 100644
--- a/internal/gitaly/service/repository/object_format_test.go
+++ b/internal/gitaly/service/repository/object_format_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/errors"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -144,7 +145,7 @@ func TestObjectFormat(t *testing.T) {
 						"[extensions]",
 						"objectFormat = blake2b",
 					}, "\n"),
-				), 0o644))
+				), perm.SharedFile))
 
 				return setupData{
 					request: &gitalypb.ObjectFormatRequest{
diff --git a/internal/gitaly/service/repository/remove_test.go b/internal/gitaly/service/repository/remove_test.go
index 06e54c58c..d777ecdfa 100644
--- a/internal/gitaly/service/repository/remove_test.go
+++ b/internal/gitaly/service/repository/remove_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testserver"
@@ -67,7 +68,7 @@ func TestRemoveRepository_locking(t *testing.T) {
 
 	// Simulate a concurrent RPC holding the repository lock.
 	lockPath := repoPath + ".lock"
-	require.NoError(t, os.WriteFile(lockPath, []byte{}, 0o644))
+	require.NoError(t, os.WriteFile(lockPath, []byte{}, perm.SharedFile))
 	defer func() { require.NoError(t, os.RemoveAll(lockPath)) }()
 
 	_, err := client.RemoveRepository(ctx, &gitalypb.RemoveRepositoryRequest{Repository: repo})
diff --git a/internal/gitaly/service/repository/replicate.go b/internal/gitaly/service/repository/replicate.go
index a5eb1ab11..5d442e1a2 100644
--- a/internal/gitaly/service/repository/replicate.go
+++ b/internal/gitaly/service/repository/replicate.go
@@ -279,7 +279,7 @@ func (s *server) syncGitconfig(ctx context.Context, in *gitalypb.ReplicateReposi
 	}
 
 	configPath := filepath.Join(repoPath, "config")
-	if err := s.writeFile(ctx, configPath, 0o644, streamio.NewReader(func() ([]byte, error) {
+	if err := s.writeFile(ctx, configPath, perm.SharedFile, streamio.NewReader(func() ([]byte, error) {
 		resp, err := stream.Recv()
 		return resp.GetData(), err
 	})); err != nil {
diff --git a/internal/gitaly/service/repository/replicate_test.go b/internal/gitaly/service/repository/replicate_test.go
index ca10e838f..8e87ae0cd 100644
--- a/internal/gitaly/service/repository/replicate_test.go
+++ b/internal/gitaly/service/repository/replicate_test.go
@@ -66,7 +66,7 @@ func TestReplicateRepository(t *testing.T) {
 	attrFilePath := filepath.Join(repoPath, "info", "attributes")
 	require.NoError(t, os.MkdirAll(filepath.Dir(attrFilePath), perm.SharedDir))
 	attrData := []byte("*.pbxproj binary\n")
-	require.NoError(t, os.WriteFile(attrFilePath, attrData, 0o644))
+	require.NoError(t, os.WriteFile(attrFilePath, attrData, perm.SharedFile))
 
 	// Write a modified gitconfig
 	gittest.Exec(t, cfg, "-C", repoPath, "config", "please.replicate", "me")
@@ -489,7 +489,7 @@ func TestReplicateRepository_FailedFetchInternalRemote(t *testing.T) {
 	})
 
 	// We corrupt the repository by writing garbage into HEAD.
-	require.NoError(t, os.WriteFile(filepath.Join(sourceRepoPath, "HEAD"), []byte("garbage"), 0o666))
+	require.NoError(t, os.WriteFile(filepath.Join(sourceRepoPath, "HEAD"), []byte("garbage"), perm.PublicFile))
 
 	ctx = testhelper.MergeOutgoingMetadata(ctx, testcfg.GitalyServersMetadataFromCfg(t, cfg))
 
@@ -532,7 +532,7 @@ func listenGitalySSHCalls(t *testing.T, conf config.Cfg) func() gitalySSHParams
 		echo "$@" >%[1]q/arguments
 
 		exec %[2]q "$@"`, tmpDir, updatedPath)
-	require.NoError(t, os.WriteFile(initialPath, []byte(script), 0o755))
+	require.NoError(t, os.WriteFile(initialPath, []byte(script), perm.SharedExecutable))
 
 	return func() gitalySSHParams {
 		arguments := testhelper.MustReadFile(t, filepath.Join(tmpDir, "arguments"))
diff --git a/internal/gitaly/service/repository/restore_custom_hooks_test.go b/internal/gitaly/service/repository/restore_custom_hooks_test.go
index f9bee0ba1..10a3a5c5e 100644
--- a/internal/gitaly/service/repository/restore_custom_hooks_test.go
+++ b/internal/gitaly/service/repository/restore_custom_hooks_test.go
@@ -178,32 +178,32 @@ func TestNewDirectoryVote(t *testing.T) {
 		{
 			desc: "generated hash matches",
 			files: []testFile{
-				{name: "pre-commit.sample", content: "foo", mode: 0o755},
-				{name: "pre-push.sample", content: "bar", mode: 0o755},
+				{name: "pre-commit.sample", content: "foo", mode: perm.SharedExecutable},
+				{name: "pre-push.sample", content: "bar", mode: perm.SharedExecutable},
 			},
 			expectedHash: "8ca11991268de4c9278488a674fc1a88db449566",
 		},
 		{
 			desc: "generated hash matches with changed file name",
 			files: []testFile{
-				{name: "pre-commit.sample.diff", content: "foo", mode: 0o755},
-				{name: "pre-push.sample", content: "bar", mode: 0o755},
+				{name: "pre-commit.sample.diff", content: "foo", mode: perm.SharedExecutable},
+				{name: "pre-push.sample", content: "bar", mode: perm.SharedExecutable},
 			},
 			expectedHash: "b5ed58ced84103da1ed9d7813a9e39b3b5daf7d7",
 		},
 		{
 			desc: "generated hash matches with changed file content",
 			files: []testFile{
-				{name: "pre-commit.sample", content: "foo", mode: 0o755},
-				{name: "pre-push.sample", content: "bar.diff", mode: 0o755},
+				{name: "pre-commit.sample", content: "foo", mode: perm.SharedExecutable},
+				{name: "pre-push.sample", content: "bar.diff", mode: perm.SharedExecutable},
 			},
 			expectedHash: "178083848c8a08e36c4f86c2d318a84b0bb845f2",
 		},
 		{
 			desc: "generated hash matches with changed file mode",
 			files: []testFile{
-				{name: "pre-commit.sample", content: "foo", mode: 0o644},
-				{name: "pre-push.sample", content: "bar", mode: 0o755},
+				{name: "pre-commit.sample", content: "foo", mode: perm.SharedFile},
+				{name: "pre-push.sample", content: "bar", mode: perm.SharedExecutable},
 			},
 			expectedHash: "c69574241b83496bb4005b4f7a0dfcda96cb317e",
 		},
diff --git a/internal/gitaly/service/repository/snapshot_test.go b/internal/gitaly/service/repository/snapshot_test.go
index 8a543c400..fe0780f08 100644
--- a/internal/gitaly/service/repository/snapshot_test.go
+++ b/internal/gitaly/service/repository/snapshot_test.go
@@ -46,7 +46,7 @@ func getSnapshot(tb testing.TB, client gitalypb.RepositoryServiceClient, req *gi
 
 func touch(t *testing.T, format string, args ...interface{}) {
 	path := fmt.Sprintf(format, args...)
-	require.NoError(t, os.WriteFile(path, nil, 0o644))
+	require.NoError(t, os.WriteFile(path, nil, perm.SharedFile))
 }
 
 func TestGetSnapshotSuccess(t *testing.T) {
@@ -137,7 +137,7 @@ func TestGetSnapshotWithDedupe(t *testing.T) {
 			// Write alternates file to point to alt objects folder.
 			alternatesPath, err := repo.InfoAlternatesPath()
 			require.NoError(t, err)
-			require.NoError(t, os.WriteFile(alternatesPath, []byte(fmt.Sprintf("%s\n", alternateObjDir)), 0o644))
+			require.NoError(t, os.WriteFile(alternatesPath, []byte(fmt.Sprintf("%s\n", alternateObjDir)), perm.SharedFile))
 
 			// Write another commit into the alternate object directory.
 			secondCommitID := gittest.WriteCommit(t, cfg, repoPath,
@@ -178,7 +178,7 @@ func TestGetSnapshot_alternateObjectDirectory(t *testing.T) {
 	t.Run("nonexistent", func(t *testing.T) {
 		alternateObjectDir := filepath.Join(repoPath, "does-not-exist")
 
-		require.NoError(t, os.WriteFile(alternatesFile, []byte(fmt.Sprintf("%s\n", alternateObjectDir)), 0o644))
+		require.NoError(t, os.WriteFile(alternatesFile, []byte(fmt.Sprintf("%s\n", alternateObjectDir)), perm.SharedFile))
 		defer func() {
 			require.NoError(t, os.Remove(alternatesFile))
 		}()
@@ -193,7 +193,7 @@ func TestGetSnapshot_alternateObjectDirectory(t *testing.T) {
 
 		alternateObjectDir := filepath.Join(storageRoot, "..")
 
-		require.NoError(t, os.WriteFile(alternatesFile, []byte(alternateObjectDir), 0o600))
+		require.NoError(t, os.WriteFile(alternatesFile, []byte(alternateObjectDir), perm.PrivateFile))
 		defer func() {
 			require.NoError(t, os.Remove(alternatesFile))
 		}()
@@ -224,7 +224,7 @@ func TestGetSnapshot_alternateObjectDirectory(t *testing.T) {
 			gittest.WithBranch("some-branch"),
 		)
 
-		require.NoError(t, os.WriteFile(alternatesFile, []byte(alternateObjectDir), 0o644))
+		require.NoError(t, os.WriteFile(alternatesFile, []byte(alternateObjectDir), perm.SharedFile))
 		defer func() {
 			require.NoError(t, os.Remove(alternatesFile))
 		}()
diff --git a/internal/gitaly/service/server/info.go b/internal/gitaly/service/server/info.go
index 59bd88269..bc3663ba8 100644
--- a/internal/gitaly/service/server/info.go
+++ b/internal/gitaly/service/server/info.go
@@ -8,6 +8,7 @@ import (
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/storage"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/fstype"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/version"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -55,7 +56,7 @@ func shardCheck(shardPath string) (readable bool, writeable bool) {
 	testPath := filepath.Join(shardPath, "+testWrite")
 
 	content := []byte("testWrite")
-	if err := os.WriteFile(testPath, content, 0o644); err == nil {
+	if err := os.WriteFile(testPath, content, perm.SharedFile); err == nil {
 		writeable = true
 	}
 	_ = os.Remove(testPath)
diff --git a/internal/gitaly/service/smarthttp/inforefs_test.go b/internal/gitaly/service/smarthttp/inforefs_test.go
index 6fabe6a21..2c08a5e88 100644
--- a/internal/gitaly/service/smarthttp/inforefs_test.go
+++ b/internal/gitaly/service/smarthttp/inforefs_test.go
@@ -545,7 +545,7 @@ func createInvalidRepo(tb testing.TB, repoDir string) func() {
 
 func replaceCachedResponse(tb testing.TB, ctx context.Context, cache *cache.DiskCache, req *gitalypb.InfoRefsRequest, newContents string) {
 	path := pathToCachedResponse(tb, ctx, cache, req)
-	require.NoError(tb, os.WriteFile(path, []byte(newContents), 0o644))
+	require.NoError(tb, os.WriteFile(path, []byte(newContents), perm.SharedFile))
 }
 
 func setInfoRefsUploadPackMethod(ctx context.Context) context.Context {
diff --git a/internal/gitaly/service/ssh/receive_pack_test.go b/internal/gitaly/service/ssh/receive_pack_test.go
index f44446cb9..8d3e7fbbe 100644
--- a/internal/gitaly/service/ssh/receive_pack_test.go
+++ b/internal/gitaly/service/ssh/receive_pack_test.go
@@ -23,6 +23,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitlab"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
@@ -220,7 +221,7 @@ func TestReceivePack_invalidGitconfig(t *testing.T) {
 
 	remoteRepo, remoteRepoPath := gittest.CreateRepository(t, ctx, cfg)
 	gittest.WriteCommit(t, cfg, remoteRepoPath, gittest.WithBranch("main"))
-	require.NoError(t, os.WriteFile(filepath.Join(remoteRepoPath, "config"), []byte("x x x foobar"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(remoteRepoPath, "config"), []byte("x x x foobar"), perm.SharedFile))
 	remoteRepo.GlProjectPath = "something"
 
 	lHead, rHead, err := setupRepoAndPush(t, ctx, cfg, &gitalypb.SSHReceivePackRequest{
@@ -359,7 +360,7 @@ func TestReceivePack_hookFailure(t *testing.T) {
 	remoteRepo, _ := gittest.CreateRepository(t, ctx, cfg)
 
 	hookContent := []byte("#!/bin/sh\nexit 1")
-	require.NoError(t, os.WriteFile(filepath.Join(gitCmdFactory.HooksPath(ctx), "pre-receive"), hookContent, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(gitCmdFactory.HooksPath(ctx), "pre-receive"), hookContent, perm.SharedExecutable))
 
 	_, _, err := setupRepoAndPush(t, ctx, cfg, &gitalypb.SSHReceivePackRequest{
 		Repository: remoteRepo,
diff --git a/internal/gitaly/service/ssh/upload_pack_test.go b/internal/gitaly/service/ssh/upload_pack_test.go
index 2dce494db..76aea6226 100644
--- a/internal/gitaly/service/ssh/upload_pack_test.go
+++ b/internal/gitaly/service/ssh/upload_pack_test.go
@@ -21,6 +21,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/sidechannel"
@@ -781,7 +782,7 @@ func TestUploadPack_gitFailure(t *testing.T) {
 
 	// Writing an invalid config will allow repo to pass the `IsGitDirectory` check but still
 	// trigger an error when git tries to access the repo.
-	require.NoError(t, os.WriteFile(filepath.Join(repoPath, "config"), []byte("Not a valid gitconfig"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(repoPath, "config"), []byte("Not a valid gitconfig"), perm.SharedFile))
 
 	stream, err := client.SSHUploadPack(ctx)
 	require.NoError(t, err)
diff --git a/internal/gitaly/transaction/voting_test.go b/internal/gitaly/transaction/voting_test.go
index 33a8ddccb..8431bc736 100644
--- a/internal/gitaly/transaction/voting_test.go
+++ b/internal/gitaly/transaction/voting_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/backchannel"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/transaction/txinfo"
@@ -207,7 +208,7 @@ func TestCommitLockedFile(t *testing.T) {
 			VoteFn: func(context.Context, txinfo.Transaction, voting.Vote, voting.Phase) error {
 				// This shouldn't typically happen given that the file is locked,
 				// but we concurrently update the file after our first vote.
-				require.NoError(t, os.WriteFile(file, []byte("something"), 0o666))
+				require.NoError(t, os.WriteFile(file, []byte("something"), perm.PublicFile))
 				return nil
 			},
 		}, writer)
diff --git a/internal/gitlab/test_server.go b/internal/gitlab/test_server.go
index 89b0dad2d..c5b42ae28 100644
--- a/internal/gitlab/test_server.go
+++ b/internal/gitlab/test_server.go
@@ -29,7 +29,7 @@ func WriteShellSecretFile(tb testing.TB, dir, secretToken string) string {
 
 	require.NoError(tb, os.MkdirAll(dir, perm.PublicDir))
 	filePath := filepath.Join(dir, ".gitlab_shell_secret")
-	require.NoError(tb, os.WriteFile(filePath, []byte(secretToken), 0o644))
+	require.NoError(tb, os.WriteFile(filePath, []byte(secretToken), perm.SharedFile))
 	return filePath
 }
 
diff --git a/internal/helper/perm/perm.go b/internal/helper/perm/perm.go
index 4bb476949..869665384 100644
--- a/internal/helper/perm/perm.go
+++ b/internal/helper/perm/perm.go
@@ -22,4 +22,33 @@ const (
 	// PublicDir is the permission given for a directory that may be read or
 	// written outside of gitaly.
 	PublicDir fs.FileMode = 0o777
+
+	// PrivateWriteOnceFile is the most restrictive file permission. Given to
+	// files that are expected to be written only once and must be read only by
+	// gitaly.
+	PrivateWriteOnceFile fs.FileMode = 0o400
+
+	// PrivateFile is the permissions given for a file that must only be used
+	// by gitaly.
+	PrivateFile fs.FileMode = 0o600
+
+	// SharedFile is the permission given for a file that may be read outside
+	// of gitaly.
+	SharedFile fs.FileMode = 0o644
+
+	// PublicFile is the permission given for a file that may be read or
+	// written outside of gitaly.
+	PublicFile fs.FileMode = 0o666
+
+	// PrivateExecutable is the permissions given for an executable that must
+	// only be used by gitaly.
+	PrivateExecutable fs.FileMode = 0o700
+
+	// SharedExecutable is the permission given for an executable that may be
+	// executed outside of gitaly.
+	SharedExecutable fs.FileMode = 0o755
+
+	// PublicExecutable is the permission given for an executable that may be
+	// read or written outside of gitaly.
+	PublicExecutable fs.FileMode = 0o777
 )
diff --git a/internal/log/hook.go b/internal/log/hook.go
index 36a6c848d..96e348b42 100644
--- a/internal/log/hook.go
+++ b/internal/log/hook.go
@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 
 	"github.com/sirupsen/logrus"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 // HookLogger is a wrapper around *logrus.Logger
@@ -24,7 +25,7 @@ func NewHookLogger() *HookLogger {
 		return &HookLogger{logger: logger}
 	}
 
-	logFile, err := os.OpenFile(filepath.Join(logDir, "gitaly_hooks.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)
+	logFile, err := os.OpenFile(filepath.Join(logDir, "gitaly_hooks.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, perm.SharedFile)
 	if err != nil {
 		logger.SetOutput(io.Discard)
 	} else {
diff --git a/internal/safe/file_writer_test.go b/internal/safe/file_writer_test.go
index dac76ff43..88e8f2107 100644
--- a/internal/safe/file_writer_test.go
+++ b/internal/safe/file_writer_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 )
@@ -48,7 +49,7 @@ func TestFileWriter_mode(t *testing.T) {
 	dir := testhelper.TempDir(t)
 
 	target := filepath.Join(dir, "file")
-	require.NoError(t, os.WriteFile(target, []byte("contents"), 0o600))
+	require.NoError(t, os.WriteFile(target, []byte("contents"), perm.PrivateFile))
 
 	writer, err := safe.NewFileWriter(target, safe.FileWriterConfig{
 		FileMode: 0o060,
diff --git a/internal/safe/locking_directory.go b/internal/safe/locking_directory.go
index 2f51e5a8e..c3baa7340 100644
--- a/internal/safe/locking_directory.go
+++ b/internal/safe/locking_directory.go
@@ -6,6 +6,8 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 type lockingDirectoryState int
@@ -50,7 +52,7 @@ func (ld *LockingDirectory) Lock() error {
 		return errors.New("locking directory not lockable")
 	}
 
-	lock, err := os.OpenFile(ld.lockPath(), os.O_CREATE|os.O_EXCL|os.O_RDONLY, 0o400)
+	lock, err := os.OpenFile(ld.lockPath(), os.O_CREATE|os.O_EXCL|os.O_RDONLY, perm.PrivateWriteOnceFile)
 	if err != nil {
 		if os.IsExist(err) {
 			return ErrFileAlreadyLocked
diff --git a/internal/safe/locking_directory_test.go b/internal/safe/locking_directory_test.go
index 4d005f8d3..9af47a54b 100644
--- a/internal/safe/locking_directory_test.go
+++ b/internal/safe/locking_directory_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 )
@@ -28,7 +29,7 @@ func TestLockingDirectory(t *testing.T) {
 		require.NoError(t, os.WriteFile(
 			filepath.Join(path, "somefile"),
 			[]byte("data"),
-			0o644),
+			perm.SharedFile),
 		)
 		assert.ErrorIs(t, secondLockingDir.Lock(), safe.ErrFileAlreadyLocked)
 		require.NoError(t, lockingDir.Unlock())
diff --git a/internal/safe/locking_file_writer.go b/internal/safe/locking_file_writer.go
index c43720cbe..bb52de6b2 100644
--- a/internal/safe/locking_file_writer.go
+++ b/internal/safe/locking_file_writer.go
@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"io"
 	"os"
+
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 type lockingFileWriterState int
@@ -136,7 +138,7 @@ func (fw *LockingFileWriter) Lock() error {
 		return err
 	}
 
-	lock, err := os.OpenFile(fw.lockPath(), os.O_CREATE|os.O_EXCL|os.O_RDONLY, 0o400)
+	lock, err := os.OpenFile(fw.lockPath(), os.O_CREATE|os.O_EXCL|os.O_RDONLY, perm.PrivateWriteOnceFile)
 	if err != nil {
 		if os.IsExist(err) {
 			return ErrFileAlreadyLocked
diff --git a/internal/safe/locking_file_writer_test.go b/internal/safe/locking_file_writer_test.go
index ee75eb76d..150eba196 100644
--- a/internal/safe/locking_file_writer_test.go
+++ b/internal/safe/locking_file_writer_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
@@ -147,7 +148,7 @@ func TestLockingFileWriter_seedingWithExistingTarget(t *testing.T) {
 	t.Parallel()
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
-	require.NoError(t, os.WriteFile(target, []byte("seed"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("seed"), perm.SharedFile))
 
 	writer, err := safe.NewLockingFileWriter(target, safe.LockingFileWriterConfig{
 		SeedContents: true,
@@ -165,7 +166,7 @@ func TestLockingFileWriter_modifiesExistingFiles(t *testing.T) {
 	t.Parallel()
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
-	require.NoError(t, os.WriteFile(target, []byte("preexisting"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("preexisting"), perm.SharedFile))
 
 	writer, err := safe.NewLockingFileWriter(target)
 	require.NoError(t, err)
@@ -181,7 +182,7 @@ func TestLockingFileWriter_modifiesExistingFilesWithMode(t *testing.T) {
 	t.Parallel()
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
-	require.NoError(t, os.WriteFile(target, []byte("preexisting"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("preexisting"), perm.SharedFile))
 
 	writer, err := safe.NewLockingFileWriter(target, safe.LockingFileWriterConfig{
 		FileWriterConfig: safe.FileWriterConfig{FileMode: 0o060},
@@ -204,7 +205,7 @@ func TestLockingFileWriter_concurrentCreation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create file concurrently.
-	require.NoError(t, os.WriteFile(target, []byte("concurrent"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("concurrent"), perm.SharedFile))
 
 	require.Equal(t, fmt.Errorf("file concurrently created"), writer.Lock())
 
@@ -216,7 +217,7 @@ func TestLockingFileWriter_concurrentDeletion(t *testing.T) {
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
 
-	require.NoError(t, os.WriteFile(target, []byte("base"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("base"), perm.SharedFile))
 	writer, err := safe.NewLockingFileWriter(target)
 	require.NoError(t, err)
 
@@ -233,12 +234,12 @@ func TestLockingFileWriter_concurrentModification(t *testing.T) {
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
 
-	require.NoError(t, os.WriteFile(target, []byte("base"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("base"), perm.SharedFile))
 	writer, err := safe.NewLockingFileWriter(target)
 	require.NoError(t, err)
 
 	// Concurrently modify the file.
-	require.NoError(t, os.WriteFile(target, []byte("concurrent"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("concurrent"), perm.SharedFile))
 
 	require.Equal(t, fmt.Errorf("file concurrently modified"), writer.Lock())
 
@@ -271,13 +272,13 @@ func TestLockingFileWriter_locked(t *testing.T) {
 	t.Parallel()
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
-	require.NoError(t, os.WriteFile(target, []byte("base"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("base"), perm.SharedFile))
 
 	writer, err := safe.NewLockingFileWriter(target)
 	require.NoError(t, err)
 
 	// Concurrently lock the file.
-	require.NoError(t, os.WriteFile(target+".lock", nil, 0o644))
+	require.NoError(t, os.WriteFile(target+".lock", nil, perm.SharedFile))
 
 	require.Equal(t, safe.ErrFileAlreadyLocked, writer.Lock())
 
@@ -290,7 +291,7 @@ func TestLockingFileWriter_externalProcess(t *testing.T) {
 	cfg := testcfg.Build(t)
 
 	target := filepath.Join(testhelper.TempDir(t), "file")
-	require.NoError(t, os.WriteFile(target, []byte("base"), 0o644))
+	require.NoError(t, os.WriteFile(target, []byte("base"), perm.SharedFile))
 
 	writer, err := safe.NewLockingFileWriter(target)
 	require.NoError(t, err)
diff --git a/internal/streamcache/cache_test.go b/internal/streamcache/cache_test.go
index 46aab75b9..9a2bb3603 100644
--- a/internal/streamcache/cache_test.go
+++ b/internal/streamcache/cache_test.go
@@ -377,7 +377,7 @@ func TestCache_unWriteableFile(t *testing.T) {
 	defer c.Stop()
 
 	c.(*cache).createFile = func() (namedWriteCloser, error) {
-		return os.OpenFile(filepath.Join(tmp, "unwriteable"), os.O_RDONLY|os.O_CREATE|os.O_EXCL, 0o644)
+		return os.OpenFile(filepath.Join(tmp, "unwriteable"), os.O_RDONLY|os.O_CREATE|os.O_EXCL, perm.SharedFile)
 	}
 
 	r, created, err := c.FindOrCreate("key", func(w io.Writer) error {
@@ -404,7 +404,7 @@ func TestCache_unCloseableFile(t *testing.T) {
 	defer c.Stop()
 
 	c.(*cache).createFile = func() (namedWriteCloser, error) {
-		f, err := os.OpenFile(filepath.Join(tmp, "uncloseable"), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+		f, err := os.OpenFile(filepath.Join(tmp, "uncloseable"), os.O_WRONLY|os.O_CREATE|os.O_EXCL, perm.SharedFile)
 		if err != nil {
 			return nil, err
 		}
@@ -430,7 +430,7 @@ func TestCache_cannotOpenFileForReading(t *testing.T) {
 	defer c.Stop()
 
 	c.(*cache).createFile = func() (namedWriteCloser, error) {
-		f, err := os.OpenFile(filepath.Join(tmp, "unopenable"), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+		f, err := os.OpenFile(filepath.Join(tmp, "unopenable"), os.O_WRONLY|os.O_CREATE|os.O_EXCL, perm.SharedFile)
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/streamcache/filestore.go b/internal/streamcache/filestore.go
index acb756dab..03b623320 100644
--- a/internal/streamcache/filestore.go
+++ b/internal/streamcache/filestore.go
@@ -111,7 +111,7 @@ func (fs *filestore) Create() (namedWriteCloser, error) {
 		return nil, fmt.Errorf("Create: mkdir: %w", err)
 	}
 
-	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, perm.SharedFile)
 	if err != nil {
 		return nil, fmt.Errorf("Create: %w", err)
 	}
diff --git a/internal/streamcache/filestore_test.go b/internal/streamcache/filestore_test.go
index adcae98d6..cad141872 100644
--- a/internal/streamcache/filestore_test.go
+++ b/internal/streamcache/filestore_test.go
@@ -110,7 +110,7 @@ func TestFilestoreCleanwalk(t *testing.T) {
 	file := filepath.Join(dir2, "file")
 	require.NoError(t, os.Mkdir(dir1, perm.SharedDir))
 	require.NoError(t, os.Mkdir(dir2, perm.SharedDir))
-	require.NoError(t, os.WriteFile(file, nil, 0o644))
+	require.NoError(t, os.WriteFile(file, nil, perm.SharedFile))
 	require.NoError(t, os.Chmod(dir2, 0), "create dir with pathological permissions")
 
 	require.NoError(t, fs.cleanWalk(time.Now().Add(time.Hour)))
@@ -119,7 +119,7 @@ func TestFilestoreCleanwalk(t *testing.T) {
 		fi, err := os.Stat(d)
 		require.NoError(t, err, "directories do not get deleted")
 
-		const mask = 0o700
+		const mask = perm.PrivateExecutable
 		require.True(t, fi.Mode()&mask >= mask, "unexpected file mode %o", fi.Mode())
 	}
 
diff --git a/internal/tempdir/clean_test.go b/internal/tempdir/clean_test.go
index b309b178e..343d747d5 100644
--- a/internal/tempdir/clean_test.go
+++ b/internal/tempdir/clean_test.go
@@ -144,7 +144,7 @@ func makeFile(t *testing.T, locator storage.Locator, storage config.Storage, fil
 	require.NoError(t, err)
 
 	fullPath := filepath.Join(root, filePath)
-	require.NoError(t, os.WriteFile(fullPath, nil, 0o644))
+	require.NoError(t, os.WriteFile(fullPath, nil, perm.SharedFile))
 	require.NoError(t, os.Chtimes(fullPath, mtime, mtime))
 }
 
diff --git a/internal/tempdir/tempdir_test.go b/internal/tempdir/tempdir_test.go
index c0e499584..627859448 100644
--- a/internal/tempdir/tempdir_test.go
+++ b/internal/tempdir/tempdir_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper/testcfg"
 )
@@ -27,7 +28,7 @@ func TestNewRepositorySuccess(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, tempDir.Path(), calculatedPath)
 
-	require.NoError(t, os.WriteFile(filepath.Join(tempDir.Path(), "test"), []byte("hello"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(tempDir.Path(), "test"), []byte("hello"), perm.SharedFile))
 
 	require.DirExists(t, tempDir.Path())
 
diff --git a/internal/testhelper/logger.go b/internal/testhelper/logger.go
index c654f959d..71ec59306 100644
--- a/internal/testhelper/logger.go
+++ b/internal/testhelper/logger.go
@@ -33,7 +33,7 @@ func NewGitalyServerLogger(tb testing.TB) *logrus.Logger {
 	}
 
 	path := filepath.Join(logDir, "gitaly_server.log")
-	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_RDWR, 0o755)
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_RDWR, perm.SharedExecutable)
 	require.NoError(tb, err)
 
 	tb.Cleanup(func() { require.NoError(tb, f.Close()) })
diff --git a/internal/testhelper/testhelper.go b/internal/testhelper/testhelper.go
index b24416a8f..71a995a22 100644
--- a/internal/testhelper/testhelper.go
+++ b/internal/testhelper/testhelper.go
@@ -258,7 +258,7 @@ func WriteExecutable(tb testing.TB, path string, content []byte) string {
 	//
 	// We thus need to perform file locking to ensure that all writeable references to this
 	// file have been closed before returning.
-	executable, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o755)
+	executable, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, perm.SharedExecutable)
 	require.NoError(tb, err)
 	_, err = io.Copy(executable, bytes.NewReader(content))
 	require.NoError(tb, err)
diff --git a/packed_binaries.go b/packed_binaries.go
index f3b532aba..de99ec8b8 100644
--- a/packed_binaries.go
+++ b/packed_binaries.go
@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 // buildDir is the directory path where our build target places the built binaries.
@@ -46,7 +48,7 @@ func UnpackAuxiliaryBinaries(destinationDir string) error {
 			}()
 
 			unpackedPath := filepath.Join(destinationDir, entry.Name())
-			unpackedFile, err := os.OpenFile(unpackedPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o700)
+			unpackedFile, err := os.OpenFile(unpackedPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, perm.PrivateExecutable)
 			if err != nil {
 				return err
 			}
diff --git a/packed_binaries_test.go b/packed_binaries_test.go
index d904ab28b..1c9941305 100644
--- a/packed_binaries_test.go
+++ b/packed_binaries_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 func TestUnpackAuxiliaryBinaries_success(t *testing.T) {
@@ -21,7 +22,7 @@ func TestUnpackAuxiliaryBinaries_success(t *testing.T) {
 	for _, entry := range entries {
 		fileInfo, err := entry.Info()
 		require.NoError(t, err)
-		require.Equal(t, fileInfo.Mode(), os.FileMode(0o700), "expected the owner to have rwx permissions on the unpacked binary")
+		require.Equal(t, fileInfo.Mode(), perm.PrivateExecutable, "expected the owner to have rwx permissions on the unpacked binary")
 
 		sourceBinary, err := os.ReadFile(filepath.Join(buildDir, fileInfo.Name()))
 		require.NoError(t, err)
@@ -37,7 +38,7 @@ func TestUnpackAuxiliaryBinaries_alreadyExists(t *testing.T) {
 	destinationDir := t.TempDir()
 
 	existingFile := filepath.Join(destinationDir, "gitaly-hooks")
-	require.NoError(t, os.WriteFile(existingFile, []byte("existing file"), os.ModePerm))
+	require.NoError(t, os.WriteFile(existingFile, []byte("existing file"), perm.PublicFile))
 
 	err := UnpackAuxiliaryBinaries(destinationDir)
 	require.EqualError(t, err, fmt.Sprintf(`open %s: file exists`, existingFile), "expected unpacking to fail if destination binary already existed")
diff --git a/tools/replace-buildid/main.go b/tools/replace-buildid/main.go
index 0eab44149..369d348c4 100644
--- a/tools/replace-buildid/main.go
+++ b/tools/replace-buildid/main.go
@@ -16,6 +16,8 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 )
 
 func main() {
@@ -105,7 +107,7 @@ func writeBinary(binaryPath string, contents []byte) error {
 		f.Close()
 	}()
 
-	if err := f.Chmod(0o755); err != nil {
+	if err := f.Chmod(perm.SharedExecutable); err != nil {
 		return fmt.Errorf("could not change permissions: %w", err)
 	}